They do? On which login do they show that information? I've only seen the kind-of two-factor one where you have to enter a code sent in a text message or with a telegram message to a different device.
https://i.imgur.com/BAnddlg.png
I counted the asterisks, they do in fact reveal the length of the password.
That... is a problem.