I ran into this when trying to paste my generated password into the password field on some kind of financial site and I think it is still the most egregious case of security theater I’ve seen yet.
Anyway, you want the “don’t fuck with paste” extension, available on both chrome and firefox.
To be fair, if you’re a W-2 employee, they already have your money from withholding. So it’s not like you’re taking dollars from the irs by not filing your return, it just means you don’t get your rebate.