I'm confident they could come up with a filler eye animation algorithm that was convincing enough to pass muster for short periods of time. Even if hand coding something didn't quite work out, they certainly have tons of eye tracking data internally they could use to train a small model, or optimize parameters.

But you could at least dampen out or randomize eye travel while looking at the keyboard. Fully reproducing eye output is a recipe for disaster, and that should have been obvious.

add sunglasses to the avatar while typing

Just have them close their eyes? That's what I do when I have to recall my password anyway.

Just do the same thing the external display does and do a 'cloudy eyes' version when they user is interacting w/ the keyboard.

If I were implementing it and wanted to obscure, I'd blur the whole screen momentarily, probably with a small message. I really doubt that's ideal for a commercial offering, though. I'm not really worried about unnerving people if I'm using an avatar, that comes with the territory as it is.

Why? Most people are capable of fixating at a single point with basically no perceptible eye movement.

It would, wouldn't it?

I'd suggest blurring the face in a "password input context" (like password fields on the web with their redacted display text), but I suspect that that'd go against what Apple wants the Vision Pro experience to look like.

Then it shouldn't be used for secure input.