@ondrej I've heard the (security) reason this is done, is to avoid phishing. A legitimate website, knowing your username, can serve a personalized—familiar to the user—password input, with their avatar, name, or a secret third thing like my bank does. A mismatch should alert the user.

On the other hand, it's foolish to assume a malicious party can't easily scrap this from the original webpage.