Seems like credentials being stored in logs is something that happens at pretty much every tech company - see e.g. Facebook[1] and Google[2]. Perhaps client and serverside hashing should be standard - at least then the actual credentials wouldn't be leaked, and the salt could be rolled the next time the user inputted it
[1] https://krebsonsecurity.com/2019/03/facebook-stored-hundreds...
[2] https://www.theverge.com/2019/5/21/18634842/google-passwords...