I'm not sure I get the issue people have with autofilling passwords, instead of making the user copy and paste.

Every password manager I've used associates those credentials with a URL. One of my accounts used to get them confused, because the company offered a dedicated login page and login via the home page on separate subdomains.

So that feature might make it harder to get phished by adding friction. And if an attacker has malicious code running on the legitimate website, how would you know?