One angle nobody's mentioned: this breaks pexpect-based automation scripts. A lot of Python deployment tooling (Fabric, Ansible's become_pass, custom provisioning scripts) uses pexpect to detect the sudo prompt by matching the ":" pattern and checking that no output follows. Asterisk feedback changes the output pattern.

Not a reason to keep silent passwords — it's the right UX change. But worth knowing if you maintain automation that interacts with sudo prompts over SSH.