Using iOS+Safari, any password entered in web forms can be securely saved on the device. When re-visiting the same site, TouchID/FaceID can be used to access the saved credentials.
I wonder if something similar is possible on Android 9 devices. I know that Chrome can save passwords, and even that it can use Smart Lock for password to save it in my Google Account. Still, when re-visiting a site, Chrome auto-fills the password field without asking for PIN/fingerprint/faceunlock.
On the other side, if trying to view the saved password via Chrome, it surely asks to re-enter the PIN/fingerprint. This is the sane behavior which I would also enable on using the password.
From my research, it seems that Google/Android/Chrome simply "trust" the user which, to launch the browser, had to authenticate himself on the lock screen (via PIN/fingerprint/whatever). Is my understanding correct, or can I force re-auth before using any saved credentials?