Even scripts within the page itself cannot read the value of password input fields. This is less of an issue than you are presenting it as.

...uhh, yes they can? Are you talking about input type=password fields, i.e. the ones 99% of passwords are entered in?