treequell contents are asterisked out
Only if the app is specifically flagging the text as a password. Which many don't. andOTP, for example is a popular authentication app that doesn't, so those codes show in the bubble. The QR code scanner for the native camera app, also doesn't mask. And I routinely use QR codes to transfer passwords out-of-band (such as getting wifi credentials).
Many apps cannot know if a string of text is sensitive or not, and many don't utilize masking because this bubble popup is new.
IMO, this feature of Android 13 should have a toggle to disable. And if Android won't do it, GrapheneOS should.