This is a very good point about infosec that a lot of password manager users overlook. Me included.

In wayland you can pipe the password into wl-copy -o so it will only be pasted once then disappear.

In Xorg you'd need a callback after running pass that runs xclip -i /dev/null some time after the password is copied.

There is no good solution to this in Linux that does not involve discipline.