I found a website that uses the plain text field as a password input form.
<input type = "text" autocomplete= off ...>
I understand shoulder surfing is one vulnerability but are there other vulnerabilities that makes input type="password" a safer option?
Beyond shoulder surfing the browser can insecurely cache data. It may save input fields in an insecure manner, for auto-fill purposes. This means passwords may be tab completed, easily retrieved as plain text, and copy/pasted.
In addition to the other answers, phones using a keyboard with 'next word' suggestion shortcuts will learn from your entry into text fields, but typically not password fields. If you have a password of common English words, it is very plausible that a phone will offer up the next word in your password if you type it, and have previously typed your password into a text field.
Only a serious issue if your phone is compromised or the database of your word predictions are compromised or shared insecurely (such as in a heuristic learning program that shares your phrases with the keyboard vendor for better learning)
