Comment by ahofmann

This looks like two different problems to me: one is the expectation of the behavior of the service (whether it talks with an external service at all) and another one is if the service is technically safe (the call to the external service makes my passwords guessable or not). I can't argue with your analogy, because it doesn't make sense to me.