Your browser is not a password manager.
If someone gets local access to your device, "password recovery" can look exactly like credential theft - and it can include saved browser passwords.
@ChrobokMatt explains where the line really is (and what to do about it) in the full #DEFCON talk: https://t.co/HiPyz3DAXQ