> Phishing is a major problem, but it happens less than you think.

Bullshit. Literally number one attack vector.

> Password managers are also checking the domain before supplying a saved password.

Password managers are not anywhere as ubiquitously used as you'd think. Even if you rely on password managers, you encounter scenarios where the website relies on a different domain that's not paired appropriately. Some "legitimate" mofos like Plaid used to ask password for third party website. Consumers don't see a password manager failure to fill out a password as a security issue. They see it as a routine password manager failure.