At an Apple Store, I've been asked this a few times. Then, I just say "I'd prefer not to" and have no problem.
In the end I just wiped the hard drive. They should've asked for that immediately.
They should have. That said, I'm confident that the significant majority react extremely negatively towards that request, so they have learned to ask for passwords first. Best practice? Definately not.