Correct answer is actually yes. And it's no different than logging in to the wrong web site. You're trusting that the server you incorrectly connected to is no

Correct answer is actually yes. And it's no different than logging in to the wrong web site. You're trusting that the server you incorrectly connected to is not capturing your failed credentials - which it absolutely does see if you're using password auth - with malicious intent. This is true for any remote system that you're authenticating to with a password that must be verified on the server side, and isn't specific to ssh's password auth.