“Manifest V3 is more secure, performant, and privacy-preserving than its predecessor.”
It’s the first thing they say.
If it doesn’t prevent a malicious extension from lifting your password in perhaps the most dumb and naive way I can think of, then it seems fairly disingenuous to describe it as “secure”.