After a human authenticates a site, the browser session stays live on the shared computer and is reachable by every Bot, so the session and not the password is the thing to plan around.

NotesDevelopers Digest gives the countermeasure: sign out of unused services to restrict Bot reach.

After authentication, the browser session may remain active on the shared computer. Plan around the session, not merely around how the password was entered.