Edit: I just cracked open the 1password extension, and it does indeed use a content script. Glancing over the code I only see stuff related to locating which fields are the username and password field - but I was mistaken in thinking that they didn't use a content script.
All the icon on the webpage ought to do is indicate to the password manager that you'd like to use it, nothing else. You shouldn't be typing your master password there, you shouldn't see a list of sites there (perhaps you just see an option for the current web page, that's fine), etc.
1Password follows this rule and has a pretty good track record overall and I too use it. There are certainly password managers that don't follow this rule; don't use them.
https://developer.apple.com/documentation/security/password_...
Edit: Of course it’s not limited to Safari, it works for in-app authentication flows too provided apps integrate it.
Connecting the application that manages your secrets to the most exposed application on your PC is a bad idea.