Yes, it's bad security. Either they have the password in plaintext or they hash each character individually. Either way, it's less secure than you just providing the full password.