The failure here was that his password manager was not configured and he manually copied and pasted the credentials into the wrong webpage.

A password manager can’t manage passwords if you don’t configure it and use it.

Yes, and we know that’s a thing which people are trained to do by all of the sites which are sloppy about their login forms or host names so we should assume that attackers can trick people into doing it, even many people who think they are too smart for it. Hubris is quite a boon for attackers.