1. Devs incorporate an OAuth code based flow. Many apps do this. Passwords should rarely need to exist on a TV device.
2. Paste using the remote app if you have an iPhone.
The first is caused by dev laziness (and possibly better for rare scenarios where there isn't a second device) and the second is perhaps a cost thing (do you have an iphone?)