It shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.
Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that.
Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.
Protonmail maybe ;-)