is pressing tab twice instead of a single time really that big of an issue? Messing with focus order is definitely a bad idea, but they could also use less semantic html to skip the reveal password "button". For people who can only use keyboards, this would make it impossible to access that feature however