Even I recall client or product owner asking for similar requests.

But I wouldn't blame them. These are people that don't know anything about security.

At least person that should have enough dignity to say "this is so badly wrong, I refuse to do it" should be the developer.