I mostly agree with you! As long as the community you are migrating hasn’t had a data breach, the data was transferred securely during the import, and you are using the right tools (like the password plugin) then you could import passwords. It’s just not something we officially support with the import scripts currently available in core.