For security reasons, user passwords cannot be fetched via the /Users API endpoint (used by the getUser method), as described in our documentation for this endpoint:
A password value is a write-only property. A password hash is a write-only property. A password hook is a write-only property.
When a user has a valid password, or imported hashed password, or password hook, and a response object contains a password credential, then the Password object is a bare object without the value property defined (for example, password: {}), to indicate that a password value exists.