Not to derail further, but iirc that’s not the case in most western jurisdictions (“intended to return it after using” is actually a defence against theft charges).

Analogies never work.

The reason that it is wrong to take my car, even if I don’t notice, are multiple:

- You are still depriving me of the possibility of using my own car, even if it happened to be the case that I didn’t need it. I could have come home early. I could have told some friend or family to pick up my car so that they could use it. I could have had an appointment that someone would come by to service my car while I was absent. All of this is made impossible if someone takes my car.

- It still causes wear and tear on my car if you use it.

- You could get into an accident, which could hurt you and damage my car.

- I don’t want random strangers to sit their butts in my car.

- etc

I think a sentences like "the Russian spy stole American military secrets", "a hacker stole my password" and "a very slow cross-site SVG filter attack stole a copy of my pixels" are perfectly valid and clear English.

Piracy is the odd-one-out because it's about "stealing" non-secret information, which seems non-sensical.

Actually, that brings up a potential problem for me because sometimes I do click the eyeball icon to show my password to myself.

This attack might be too slow as long as I hide the password within 30 seconds, but future versions of the attack might be fast enough to capture multiple characters, especially if the malicious website hosting the iframe knows which pixel positions will be occupied by the password box.

Imagine you're a shady streaming site running tons of shady ads. Now imagine one of your shady advertisers loads a shady iframe using this exploit. The targeted user keeps that tab open for a few hours- they're watching a show, after all. As the streaming site loading the add, you're none the wiser.