It sees all the visible chars? Not just what I type? So every time I ls all of my filenames and dirs get sent?

That might be worse.

This seems dubious. Does that mean key loggers can't see it?