I've tested with Firefox 76.0 and Chrome 86.0.4240.111 and I see autocomplete="current-password" in both which is what I'd expect given the Moodle source code. And it's also what you're seeing with Curl. Could your browsers be going through some proxy which is modifying the source? The proxy would have to be intercepting the secure connection somehow. Or maybe there's a browser add-on modifying this?
"Is this HTML actually coming from two different files in Moodle then?" – lib/templates/loginform.mustache is for the login page, blocks/login/block_login.php is for the optional Login block. Does that answer this question?