Pretty much.
In addition, for apps that do let you copy passwords, there’s a way for them to set a MIME hint with the paste data that makes it not appear visibly in the clipboard or get remembered in the history; see for example 156547 – Passwords copied from kwalletmanager should not appear in klipper. As you can see, we don’t even set this for all of our own apps! So there’s low-hanging fruit there.