I don't really see a security flaw here. The lack of documentation may be justified, but the way I read this is that we don't know what exactly is send to Apple

I don't really see a security flaw here. The lack of documentation may be justified, but the way I read this is that we don't know what exactly is send to Apple. They could very well use hashed and salted passwords to verify.