All true, but it is still bad style. There is no need to keep decrypted passwords in memory the user hasn’t even used in the session (or after they logged in to a certain website).
What I don’t need doesn’t need to live unencrypted in my RAM. Of course I do. It is standard behaviour of iOS, and of a lot of password managers. If someone grabs my laptop and runs, at least they can’t capture my hn account.
