I feel like this would be better as a Well-Known URI, for example /.well-known/password-manager.json with similar format to the repo – That way it's not up to Apple to decide what goes in the repository
Sites would immediately use it to essentially disable password managers "for security." Sites have done everything they can to block password managers historically, I don't anticipate that changing.
You're asking the wrong person: Sites shouldn't do that. But they do, often.
Banks are the worst offenders, but it isn't limited to that. Any site that thinks it is "special" and requires "extra security" targets password managers for reasons unknown.