They store all the passwords encrypted (not one-way hashed which is the recommended), and they can only be retrieved and reversed after a member of the security team opens a ticket and explains the reason for using the password (like to investigate malware)
They got root access (at least most hosts I know do), why would they need to reverse an encrypted password that would give them less access than what they already should have? Seems like BS.