What if browsers exposed the capabilities to locate the inputs, act upon user input, supply generated passwords, etc. in a sandboxed manner?
https://developer.apple.com/documentation/security/password_...
Edit: Of course it’s not limited to Safari, it works for in-app authentication flows too provided apps integrate it.