Vulnerability in 1Password

or is the author simply arguing that this should be the default behavior?

The author argues that, which isn’t directly wrong, but I wouldn’t call it a vulnerability.