The same way, you can set the extension to automatically fill in and confirm, so it has the same flaw. It is not the default setting afaik.

It's disabled by default, and it's made clear that enabling it is a security risk