Not in my tests, it continued to aggressively populate forms with autocomplete="off" set.

That would be because that attribute is for a different feature of the browser. The autofill that this method takes advantage of is more of an extension beyond the standard browser feature.

Besides, someone using this for a phishing method wouldn't use that attribute anyway.