Seems like a bit of a stretch. You really shouldn't be putting anything extremely sensitive into a browser anyway, and Keybase calls it out themselves. Yes, it's missing from the extension page, but that's really the only "mistake" they've made.
So why does Keybase inject the textbox there? Injecting an input for a secure chat app into an insecure location is going to make people who trust keybase misunderstand the security profile of that input.
Is there another location they could? I'm not familiar enough with extension development to speak confidently but my understanding was that you had to manipulate the DOM if you wanted to impact I/O of the page
Per the post, if you click the button right in the browser menu bar, it spawns a chat window that’s outside the page DOM
Other than the post recommendation, using a secure "blank" iFrame hosted on their own domain might have worked as well, depending on their threat-model.