Not always, but it happens enough that they'd need to be able to log-in.
Still agree that asking for your pwd is reckless.