Passwords can leak in many ways other than database breaches. Malicious front-end code and accidental logging that goes to a public place like an S3 bucket are two examples.