That's worrisome; they should be using a purpose-built key derivation function, like PBKDF2, bcrypt or scrypt. Using only SHA3 means it is easy to brute-force the key by searching for likely passwords.