There’s a non-zero probability that people will paste their private keys into the draft text box. Bots will collect them without the user knowing. No data should be transmitted before hitting or , but it seemingly is at the moment due to some “reactive” design or smth.