[ycmbntrthrwaway]

Why not? Anyone who wants to steal your information would not try to disable autocomplete anyway.

[avodonosov]

You're right, following standard in regard to autocomplete=off will not prevent this attack.

I think I remembered of that because the direction of though that autocomplete should always be enabled appears as wrong to me. And this situation reminded me of this direction of though in the past case.