[skip]

Well from a technical standpoint you are correct. Although, if I see buggy/weird behavior on a website, right away I question what sort of hidden unsavory stuff is happening on the server side.

But there is an issue even if the implementation is totally seamless and bug-free. Maybe one site implements this slightly differently, and maybe some sites have a checkbox to clear the mask, or other sites show me each character for a fixed delay (e.g., character disappears after 250 ms or something), etc. In each case I must make some accomodations to how I expect a password field to behave. On the other hand if it is at the application level then there is opportunity to evolve the feature uniformly across all websites--and also give the user a single option which controls the behavior.