It's more like "passwords are startlingly dumb". Yes, they're conceptually simple. No, they're not so hard to do right. But! They are not ergonomic, relevant, or good solutions for the problems they solve.

If authentication is important, you probably shouldn't be relying on passwords for it. If authentication isn't important, you're just draining attention and energy from more important things, and promoting password-laziness and auth-fatigue.

Far too often, authentication is just another hassle, more of an antipattern than a benefit or necessity.