Fine :)

Can tests that hit an external network at least be a close second?

Yep.

My understanding of this larger issue is that Apple has tried (or succeeded?) in exposing more isolated/secure APIs for form filling but 1Password, and I assume all other extension, don't use it. It seems like something all browsers could be doing.

I’m going to frame this skeet. “Go did it right” —Felipe

It's so frustrating that my password manager even has permission to do this. Almost makes me want to run extension-free.

Thanks for taking the time to write this up.

I'm really glad you're getting ahead of this and I'm looking forward to seeing the new reviewer guidelines.