It's not ``BaseProperty`` that you have to cast to. It's ``PropertyClass`` because ``getXClass()`` returns a ``BaseClass``, whose javadoc says:

    Represents an XClass, and contains XClass properties. Each field from {@link BaseCollection} is of type {@link PropertyClass} and defines a single XClass property.

I agree that the cast is not very clean, but if you search for ``(PropertyClass)`` cast in oldcore you'll see that it's quite a common practice. In the case of a password property the object returned by

    object.getBaseObject().getXClass(getXWikiContext()).get(fieldName)

is (currently) an instance of ``PasswordClass`` which extends ``PropertyClass``. Check the javadoc for ``PropertyClass#getClassType()`` to understand better my previous comment about XClass property roles.

As for why only ``PasswordMetaClass`` is a component, the reason is that it serves as a factory for ``PasswordClass``. So if you change the factory you may want to change the implementation of the type of object created by that factory. ``PasswordMetaClass`` and ``PasswordClass`` are bound together.