> MD5 is known to be very insecure and you should never use it for real world password hashing. Instead, you would use SHA-512, SHA3 or another highly secure algorithm.

No, you should use a (poorly named) "password hashing algorithm" which has different security properties from normal cryptographic hash functions.

Later on they indicate that they're using PBKDF2-HMAC-SHA512, which is outdated and not as good as scrypt or bcrypt, both of which are offered in the pycryptodome library they're using. The only reason to use PBKDF2 is for backwards compatibility, or with systems that don't offer better (memory-hard or cache-hard) algorithms. The documentation even states "New applications and protocols should use scrypt or bcrypt instead."[1]

Hardly ultra-secure. They didn't even bother reading the docs of the crypto library they used.

[1] https://www.pycryptodome.org/en/latest/src/protocol/kdf.html