That's true - but you have no way of knowing what the app will draw. A malicious app could display a username & password field over a different app and steal your credentials that way.