The OS could draw an ugly censoring block over the sensitive information. That would protect the user's privacy when needed but also prevent apps mis-using the feature like this.

I don't think Apple cares about apps replacing the follow button with an icon. It's a weird use of the api, but it's not abusing the user or a security/privacy risk.

Yeah. I wonder if Apple does something to change this.

This is a failure of imagination for Apple, but it’s hard to blame them.

Who would think someone would put a button inside a “secure” text field and change the masked appearance to a logo?

If I was proposing this feature, I would never imagine someone would come up with something like that.