You can easily put any open source security system behind a secondary system. Hell - it would already be a secondary system.

Not putting your passwords right next to the identifiers is a simple way to lower the impact of an email or password leak.

Also, that quote is bullshit.