The funny thing is that I have an older Alpine 13.5 box on which all the passwords are '!' not '*', which actually seems to prevent this (because the issue is crypt() returning * on error).

#neverupdate