Pasting a password into a phishing site because you don't have the browser checking the domain for you seems like a bigger risk than being exploited by something like this.
So in addition to being my password manager, pass and my wrapper script are my cross-browser bookmark manager, which is convenient because I'm usually in a terminal emulator.
I've never understood why people at HN use graphical password managers that are integrated into web browsers and autofill, etc. (but I've never understood why people at HN use most of the graphical software they use).
Most people, self-professed hackers included, are more comfortable in the browser sandbox than the terminal emulator sandbox.
pass has a better UX than any password manager I’ve ever been compelled to use for work. Especially when used in the way you describe, as your index to the browser (rather than as a sidecar to the browser).
That said I understand that when a password manager is closely integrated with (or even within) a browser, it can do more checking for me, and make the whole experience nicer. But such integration is imho not a silver bullet, and there are downsides which comes with this approach as well.
If your email is hidden, then someone might send you a phishing link via a HN reply. The reply might link to a website that has a domain similar to Facebook and presents a Facebook phishing login.
On the other hand site-specific logins tend to last longer which means I'm unlikely to encounter a login prompt as part of regular browsing.
To given an example, github only prompts me for my personal credentials when I use the security settings or to authorize a bot. This doesn't happen often, so it's somewhat surprising and makes me check. But my $WORK SSO tied to their github org (and a whole bunch of other things) wants me to log in every other day. This makes more less likely to check since it's forced routine.
I don't think consumer SSO does that. I think Facebook and Google generally try to avoid logging users out randomly because it causes user annoyance as well as user loss (because a lot of users might not remember their passwords or bother logging back in again).
Your work SSO can tolerate a bad user experience in order to have higher security. You're being paid to log in every day. Facebook and Google users aren't being paid to log in every day, so many of them won't.