If you're using chrome, the omnibar seems to send out whatever you type to (google's?) server for search suggestion, so you shouldn't do that if you're copying sensitive data. You can use ⌘+shift+v to paste the text without formatting (and without sending your data to some random servers).

I used to do this until I learned CMD-SHIFT-V which pastes without formatting so the text appears in whatever format the destination document uses

That's exactly what I do every time, and I became unnaturally quick in this insane dance.