config hub and/or sp-config are not 100% reliable on backup or export sources when talking about password. It seems it was designed to not export it, which is fine.
but caveat is that it still exports some source passwords...
https://sailpoint.atlassian.net/issues/IDNETN-8101?jql=text%20~%20%22sp-config%20password%22%20ORDER%20BY%20updated%20DESC
(this ticket is still valid though, got a customer with that situation last month).
still it might be good to explain they should not expect passwords to come in exports or backups
