Except, if there is XSS, its usually in user submitted data, like a post. You wouldn't type in your password on a user post or alert box. And the login page is usually on a different page altogether, by itself.
Depending on the nature of the site, it's possible it won't even stand out as odd even if it loads a login control at a non-"login" URL.
If an attacker leverages an XSS they can exactly replicate the login page, URL and all, only limited by payload size and modern protections like CSP.