Maybe, but it conceptually it doesn't have to be like that. Often, the password is not sent directly, but its hash is sent (sometimes hashed multiple times), so that the same property is true.
With private/public key pairs, the same scenario would result in the attacker only obtaining your public key, which is useless without the private key.
In general however, I believe that there is no inherit advantage of certificates over passwords, except for the key-size obviously. Everything else is just convention/standards.
Please see the following page that explains better what I meant when I said that the password should be hashed: https://en.wikipedia.org/wiki/Hash_chain
Using such a mechanism (including salts / challenges) will prevent an attacker using the hash as the password.