The widget "password" does not update its internal value when it is invalid.
So if you set a valid value and then an invalid value, the field value will be the valid one and a form submission will work whereas you have an invalid field