I believe code inside bzrlib should not use getpass function directly but instead need to use corresponding function from bzrlib.ui package. Otherwise such change will break GUI clients, especially QBzr.