Minor fail by bitwarden...

- odds of arbitrary malicious iframe being on login page seems vanishingly small, especially when a compromise of the login page is probably necessary before the iframe can be injected. How often can an iframe be injected but not arbitrary js?

- iframes having autofill should definitely be a sub option on such a feature.

Either way, also curious about other password managers and their behaviors here. TFA doesn't go into that, seems like a big omission.