Sometimes it would increment counters for visited sites without you using the app, which likely means that sites are able to track you if you have an entry in Passwords.
Alternatively, some sites do not show up in logs even though icon shows up for a site/password entry.
And what is the news here ? Apple fixes vulnerabilities only after they are discovered by others.
Since it pops up a web view which I presume is webkit/safari, I wonder if the Safari setting “Not Secure Connection Warning” (which you should set to on), is correctly applied to the view. Obviously it’s a bug they used http in first place, but this would have helped.