Should vanishing an account remove its password and other login credentials?

In T368524, it was apparently decided that vanishing an account should not remove its password. Despite that, code was added to remove the password when vanishing. This code did not work correctly for some time, and it was recently fixed in T418122. Currently password and other login credentials are being removed when vanishing.

Accounts with no password or other credentials are labelled as as "system users" in some places in the interface (e.g. Special:UserRights), which led to a lot of confusion, leading to task T420848. That labelling can be improved, but I'd like to have a decision on this first. The method used to remove credentials is also called newSystemUser, so this is confusing in the code as well.

If we don't remove passwords, we risk that they would be included in a future data breach, if we ever suffer one. Since we also remove vanished users' emails (I assume this is not controversial), we wouldn't even be able to notify these users about the data breach.

If we remove passwords, then vanishing can't be reversed by stewards (by just renaming and unlocking the account); sysadmin intervention is required to set a new password and/or email for the user before they can log in. I'm not sure how important this is, given that we claim that vanishing is permanent (ref1, ref2), but this has been raised (ref).

Passwords are considered personal information in our privacy policy (ref), and we suggest that personal information can be removed when vanishing (ref), but we never straight-up say that we do or don't remove passwords.

[A secondary question is: Should other login credentials be removed as well? (e.g. 2FA information, passkeys, and more obscure auth methods like owner-only OAuth clients). They are less likely to be considered PII than a password. On the other hand, it seems wrong to leave an account in a state where it can be used, but can't log in normally. Currently it seems that other login credentials are being removed as well (although I didn't review every auth method to ensure this).]

Desired outcome: I'd like to ask the PSI team to make this decision, ensure that stewards are on board with it, and document it on-wiki. If we decide that the passwords should be removed, we should also start another task to scrub them from accounts vanished before the change from T418122 was deployed.