All browsers right now basically assume that if you have an input type="password", then the previous input type="text" must be the username field. And there's little you can do to change this without resorting to substantial hacks like using a hidden username-looking honeypot field to eat the poor browser behavior.
For example, imagine a pop-up confirmation box that asks you for your password before continuing. Or really just a "confirm password" field on any form. It can be very hard to get browser or extension password autofill to only affect that one field and not inject a username into some other field on the page. Password managers in browsers and extensions are surprisingly brain-dead, and they give us no tools to help them out.
To put UX first, especially around something as UX-sensitive as password autofill, you end up needing to put in a lot of extra work to make up for the browser's confidently-wrong implementations.
The original decision to ignore autocomplete="off" was probably the right move. But now that the autocomplete attribute has been overloaded with password manager concerns built in to web browsers these days, nobody has bothered to revisit the ordeal.