I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places wher

I always assumed the point of those types of passwords is to prevent anyone MITM the password since you have to communicate it by voice and often in places where people might overhear. So you have a password but ask for a different (random) combination of 3 characters from it each time. It’s kind of like a TOTP code for noobs (not even remotely as good as TOTP but something your gran could still manage understand). The services I know which do this will have an additional password for online stuff which is different to the aforementioned and does have to be supplied in full. Thus, you’d hope, is hashed and salted etc. However you don’t supply that password when making phone calls. Sometimes you even have to supply both pieces of information when logging in online.