Or just nobody did care. Contractor's main expense are kickbacks and actual product is made by cheapest subcontractor.
Any script that was doing a password comparison client-side was laughed at in the past -- rightly so --, but now that MS & Google see a business case it's fine? (And a password being a secret, is basically the same as the answer to a question).