Developers can always add stuff to steal your passwords, it's really easy to do so since runescape stores your username and password in the client.
ALWAYS have a bankpin and bank your stuff before log off, or use the authenticator stuff that RS offers, although that won't work very well with autlogin on most bots.