I would argue that pass isn't that secure other than when your computer is off.

Namely that it requires copy and pasting. Any program on your computer can read your clipboard.

And for a normal user who are more vulnerable to phishing, there isn't automatic domain checking. It would be their normal work flow to copy a password into a malicious site.