My password manager will never fill my password into the wrong site. I would need to do so manually which sets of so many alarm bells in my head.

With email pasting the number into a random website is the expected flow and there is basically no protection (some phones have basic protections for SMS auth but even this only works if you are signing in on the same device).