They did at one point but not anymore. But either way any password filling is as secure as plaintext since it's pasted as plaintext, and you can just edit the DOM after it's filled.