oh ok lmao, Apple snubbed my security report.
visionOS's security model is so confusing to me bc 2D apps aren't allowed to see eye movements+hands bc typing/hover is sensitive right? But Persona broadcasts all of that to any app that asks incl during password boxes.
intended behavior apparently, idfgi