Each website must request and be granted by the user that explicit permission. Barring that, a bad actor would have to physically access your computer to install a keylogger (or I suppose one could be installed through a phishy attachment). Clipboard-stealing isn’t anywhere near as big of an issue as cookie-/session-stealing.