They can always alter the login code to secretly log the passwords in plain text the next time the designated users log in.

There is no law in Germany (or anywhere else that I'm aware of) that would compel a company to do this.

I hope there isn't. But my point was that in the event they are indeed compelled by law to reveal passwords, this would be the only way they'd achieve that.

See my other comment - the law is about access codes like SIM PUKs and drive encryption keys, not passwords.

Gdpr violation?

No, required by another law.

There's an explicit exemption for state security in GDPR (and indeed ECHR Article 8)

I hope so. But handover all hashes?

That's most likely what will happen, simply so that the companies can say that they complied with the law.

Let's hope they're salted and they use something very slow to bruteforce

Hope is not a security solution.

Sure isn't, but that's how proprietary software is, you only have hope.