This is about 2fa, not passwords.

With 2fa, you control the allowed character set, and as such can make sure that what you mention cannot happen.

Mind you, 2fa is stupid for a whole lot of other reasons, but that's another matter.