It doesn't log passwords using EnableSecureEventInput. There are probably other use cases, but Apple seems to have implemented things rather well here.
It would be nice if macOS had the same permissions models as iOS, and then some. A permission before apps can access the camera, or access what keys are held down when the app isn't in the foreground - that would block this case.
New apps in the Mac App Store have to run in the sandbox and they are quite severely limited.