It's deeply insecure in most of the ways it is used.
But people don't care about security, that is obvious, they only care about UX