I think there's literally no difference between the phishing and real pictures.
Things that would make me notice this: My auto password is not popping up (yes I use that). I could drag the window to top or make it full screen and that won't work. I could check if another window is actually open in the taskbar
On macOS with 1password, there are numerous occasions where this is the case, from SSBs and electron apps, to random other things that 1P just doesn't see. I have to copy/paste my password just often enough that I'd probably fall for this in-browser if I weren't paying much attention.
On my Windows 10 work systems, I turn off the default "hide and collapse" behavior so I can read the window titles.
I know normal users cannot read, but the titles are useful for me.