I don't know if that's a fair reading of the functionality. It seems likely your mistakenly pasted password will generate an autocomplete and the (mis-)matched "spec" command will be sent as the telemetry, e.g., pasting "gi)#(RCS23!_)(U" into your terminal might result in "git" telemetry, not the password itself.

It's one of those things that is just trivial to introduce breaking changes to, though, intentionally or otherwise. And as-is the functionality does share what amounts to the terminal activity in normal cases.