The problem isn't password list specific. The culprit is focus_row_behavior.js. FocusRowBehavior.onFocus_ moves the focus to the menu button:
this.row_.getEquivalentElement(this.lastFocused).focus();

Without this line the bug isn't observed.

Moving to dpapad@ for triaging.

There is a known issue with FocusRowBehavior and Shadow DOM v1, see  issue 896624 . This maybe related?

@rbpotter: Can you check if your candidate fix at https://chromium-review.googlesource.com/c/chromium/src/+/1325352 also addresses this issue?

Can someone with a Mac test whether this bug also occurs in Chrome Stable (M70)? If so, this is probably the result of the intended behavior, which is to keep focus on the same control when the user moves up and down the list items.

If not, this may be related to the issue linked above. Specifically, if the issue described in that bug, of the item being removed from the tab order, is fixed by never setting the tabIndex to -1, a new issue occurs: by default focus will return to the most recently focused control when it leaves the list and then returns to the list, instead of returning to the first control in the most recently focused row. 

https://crrev.com/c/1336657 is a candidate fix for this, but not sure if it will address this issue, since it watches for focus to leave the list in order to determine if it should focus the first control instead of the last focused control. It seems like fixing this would require differentiating between the user navigating to the next item with the screen reader vs the arrow keys.

Yes, it's reproducible on both Stable and Canary. 

Since (based on comment 5) this does not seem to be related to Shadow DOM v1 and instead seems to be an issue with FocusRowBehavior's interaction with VoiceOver on Mac, unassigning myself since I do not have a way to reproduce this so am unlikely to make any progress on fixing it.