EncryptedPasswordMixin.setPassword is public and does its own security
checks, this is since 7d0882ef (setPassword have to do explicit
security checks…, 2007-11-12), but a few months after this, we teached
edit to check security - in d1312cdb (make edit check the security
remove all useless security declaration on private method, 2008-05-23).

In the end what really matters is that end users can not change passwords
through the user interface when editing logins documents.