Rob,
Oops, I'm sorry. I just realized you were talking about the quiz password, not the login password. Please disregard my previous post.
The quiz password seems to be fairly well protected. When masked, you obviously can't see it in the input box but also in the Developer Tools.
Hiding the Mask/Unmask icon with a CSS property solves the issue. But of course any user can override this property in the DevTools and view the password input.
In terms of security, I wonder who would be interested in revealing what the student is typing when the mask is active. Certainly not the student entering the quiz password, if it's agreed that input is masked. Nor the teacher, as they are the one who added the password in the quiz settings. Maybe an administrator? But it's probably not easy to permanently hide it from them. Someone else other than the student? This person would need to be next to the student and inspect the login page without the student noticing. Hard to imagine.
I might be overlooking some scenarios, but I suggest either 1) hiding the icon with CSS or 2) following Tim's advice. You could also tweak the Moodle code. That would be a bit more secure, but there are probably applications that would allow a malicious person to still discover the password.
I realize this topic is a bit beyond me. So, I'll leave it to others to provide further details or corrections if needed.