What if someone gets into your app logic and make a POST trigger that gets the passwords out.

What if you log all POST requests for debugging purposes and forget to sanitize the logs.

What if you have XSS in your web app that sends the password to a third party.

What if your mobile phone app has a dependency that includes a keylogger.

The likelihood of this increases the more layers you have in your organization (for example, the log pipeline team assumes the logs are already sanitized; the login form team assumes the log team is sanitizing them; it all goes through some A/B testing team that just dumps all data to "data lake" somewhere unsafe; the FE team puts in random node.js dependencies as it's "just a frontend"; etc).

Passwords can leak from more places than just from the DB...