Because it is happening without user's consent. Imagine you invite me for a drink in your home, and while you're not looking I go and open the front door, for whichever reason. How would that make you feel?
This looks like two different problems to me: one is the expectation of the behavior of the service (whether it talks with an external service at all) and another one is if the service is technically safe (the call to the external service makes my passwords guessable or not).
I can't argue with your analogy, because it doesn't make sense to me.
How? What is you definition of unsafe?
Because it is happening without user's consent. Imagine you invite me for a drink in your home, and while you're not looking I go and open the front door, for whichever reason. How would that make you feel?
This looks like two different problems to me: one is the expectation of the behavior of the service (whether it talks with an external service at all) and another one is if the service is technically safe (the call to the external service makes my passwords guessable or not). I can't argue with your analogy, because it doesn't make sense to me.