I ask myself the same question and I always stop at thinking that its just the 2FA tokens and not the actual passwords.