Good point, though I imagine that this issue could be fixed in SSH as long as the password is not being echoed (which it should not be).
They could potentially use this information to know the length of a password, which would make brute-forcing easier. A very hypothetical attack, but fun to think about! Less effective than a $5 wrench, no doubt.