hogepodge, this is not a typo. 

Parameter 'password' passed here https://github.com/puppetlabs/puppetlabs-mongodb/pull/70/files#diff-47d8b53e6586700bede6020db99b8f0cR13 and after 'mongodb_password' function it passes to 'password_hash' of 'mongodb_user' resource.