Those are poklit popups, similar to UAC on Windows. The program doesn't get your password, but depending on what kind of access it requested, it could give it r

Those are poklit popups, similar to UAC on Windows. The program doesn't get your password, but depending on what kind of access it requested, it could give it root access. If implemented correctly, the popup should say "wants to install a package" or "wants to mount drive X", which runs a predefined action on behalf of the app and doesn't actually give it any elevated permissions. Of course, like UAC, an app could just make its own prompt that looks like the real deal and steal the password, but that seems to be an unsolved problem on every platform.