Imo it’s not html, it’s browser vendors. There’s a decent specification for the `autocomplete` attribute: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

It is actually a reaction to websites doing stupid things to try and prevent password auto-fill. The sites are fighting against security in a misguided attempt to improve security, so the browser vendors added a bunch of heuristics to try and correct these situations and you end up with the mess we have.