There's nothing stopping a malicious actor from acquiring a passcode by force as well.

https://xkcd.com/538/