The user should have control over this behavior and not the person developing the form. In the case of web browsers, that's where the control should lie. Otherwise, you're presuming that everyone would be OK seeing them in every situation.
This usability issue has been solved in countless frameworks and most mobile operating systems. The last typed letter is shown for a period of time before being masked.
As usual, Jakob Nielsen demands a change in the user interface without providing a comprable or better alternative, stating that developers should revert to the original context should the operation require a higher grade of visual security.
Where he also fails is in acknowledgement that users have already devised their own methodology for circumventing this particular difficulty and furthermore, offers no insight on how to improve upon their methodology.
Yes, the article is from 2009 and without even a glance, I'll go ahead and assume that Mr. Nielsen is even more irrelevant today in the usability discussion than he was then.
