Because you don’t login via the site, you have to go through Matrix’ login flow, just like with any client.
Then why does the popup on Cactus ask for the password? If the matrix homeserver is responsible for the authentication, then cactus should probably only ask for a matrix identifier (user:server).
On a second look, I agree.
You don't, you have to trust it just like any other Matrix client. Hopefully there will be OAuth or something similar in the Matrix spec in the future, so you can use less trusted clients. If you want to comment with your user, but don't trust the client, you can use any Matrix client with Cactus Comments by clicking "Use a Matrix client" :-)