linus is notoriously opposed to security, calling the security community various names over the years. the capabilities exposed by the kernel have direct impact on userland. if security isn't a priority for linus and is left to third parties, then you wind up with all sorts of stuff that is the ecosystem we have today. some is great, some is awful.
without attention and respect from the guy in charge of the kernel, which gates security for the system, this is what you get.
It's not Torvalds' responsibility, implied or otherwise, to manage what kind of password userspace requires for setting config settings.