> Fundamentally, if you're giving an application your passwords, it is precisely so that the application can transmit those passwords, in full, to the relevant services.

This is about secrets in general. Those could just as well be used to encrypt local data or sign session cookies for the internal web page. And sending the secret to the service it is for is different than sending it (or at least a part of its hash) to another service the user might not trust.