Absolutely right-- the warning is only necessary if they're not hashing the password before templating the string prior to storage.

you could still hope it's a WAF issue or they're hashing passwords through the database query, though both unlikely

Naturally. You just use a different name for that field than password, and the hackers will never know! /s