You can also just run it when you need it rather than having to add an extension. Just add a bookmarklet with the code here and just click it when you encounter a problematic website.
It’ll reduce your attack surface while still getting the job done.
https://github.com/jswanner/DontF-WithPaste?tab=readme-ov-file#bookmarklet
That’s exactly what someone malicious would do though, either in a single password submission or DOS via the password maximum repeatedly. IMO there is no functional security difference between a 64 and a 256 character password, so the NIST 64 character max is reasonable.