They are saying if you download an application (e.g. vrchat.exe) from the internet than it can steal your passwords as soon as you launch it.

That's not what VRchat's blog post say at all, though.

"Every month, thousands of users have their accounts stolen, often due to running a modified client that is silently logging their keystrokes as well as other information. These users – often without even realizing it! – run the risk of losing their account, or having their computers become part of a larger botnet."

People running a backdoor client and getting their passwords stolen? That doesn't sound... wrong?

The wrong part is that somehow EAC will help prevent that. It won't.

It would prevent it in a way that you know that the mod you are downloading is not likely to work and you wouldn't download it in the first place.

Not really, some mods will still work

The chance of some application downloaded for free on the internet will bypass EAC is minuscule