But how would it know there's an XSS vuln?

Yes of course, and your enterprise network have a password strength checker on post requests too I guess? meh.