Erps, missed this message before. Apologies.

It doesn't look like core sanitizes the password either ([ref](http://core.trac.wordpress.org/browser/trunk/wp-login.php#L478)). I suspect because the password always ends up, and used, in its hashed format. It's fine to just leave a comment as such in the code.