This came to my mind too. But by using a password manager it will be able to differentiate between the GOOD and BAD site. So I think the point is valid only if the user is not using a password manager.

Or copy pasting passwords manually. In that case the password manager is equivalent to a list of passwords on a sheet of paper.