For those that are confused, updating the property would mean:
this.input.value = 'password';
This would be fine. However updating the attribute (the way React recommends it with controlled components) would be something like:
<input type="text" value={this.state.value} onChange={this.handleChange} />
This would be vulnerable to the the CSS keylogger.