I actually added this same type of warning when I worked at lastpass.com (you can see it on their login page).
It's attempting to solve the "people" problem in security. Even if you can make a site bulletproof from XSS, it is very difficult to stop users from compromising themselves.