If the attacker has obtained access to the server, he can simply modify the code to not filter passwords from the log file anymore. I don't see how this is a su

If the attacker has obtained access to the server, he can simply modify the code to not filter passwords from the log file anymore. I don't see how this is a surprising problem.