As ThoriumBR states, yes the browser extensions should validate the domain and only fill the credentials if the domain matches.
It is way better to let the browser extension fill the credentials than using some "auto-type" shortcut that only matches the windows name to type the credentials... the latter cannot validate the domain properly and will be fooled by a website faking the
Obviously I'd say to avoid trusting unknown extensions you find randomly that are not used by many people... validate that the extensions is written by someone you deem can be trusted.
I just wanted to add that I would suggest to disable auto-fill because it might cause a different minor security issue.
Your browser would load the URL, the credentials get autofilled and the malicious code run and sends the credentials to the malicious actor.
In this sense it gives better security to only let the browser extension fill the credentials when you decide to do it...
Then again, in the situation described above, depending on the attack and how careful you are at looking at the full URL you may or may not still end up manually triggering the autofill, but it gives an extra step for this kind of exploit to work.