It is a protection from "shoulder-surfing". I agree with you, there has to be an option to reveal the password if needed.