If you show it on a screen, someone will read it out and type it into a website. We don't need to guess at this, it happens a lot in the real world.

No matter how many UX barriers you put in place, an exportable credential will be handed over to an attacker by an unwitting user at some point.