Yea I was thinking about this too! We can talk all day about static typing vs productivity but if they had a basic string type called PasswordHint and Password then maybe (maybe!) this wouldn’t happen.
I'd leave passwordHint as a string; but password... That might be an interesting type. Particularly if it zeroed out memory as a freebie in the destructor. Actually that was my take-away from this article, the "maybe in MY projects I should wrap passwords in a special type to stop me typo-ing the raw password to output."