So is the TL;DR by default bitwarden sends basic auth (always, even if 'autofill' is off, because of limitations of the webextension API) to other subdomains (up to the public suffix), people don't like this because they use broken sites that aren't on the PSL list but are effectively public suffixes, and so bitwarden is changing the default to only send basic auth to strict hostname matches?

This seems like kind of a nothingburger security wise to me.