Let's take a look at the code! A few seconds of Googling led me to a high-quality annotated disassembly by Kent Hansen and Nick Mikstas: https://www.metroid-database.com/source-code/
Whenever the user is on the password screen, the following routine runs every frame:
L9147: JSR EraseAllSprites ;($C1A3)Remove sprites from screen.
Fundamentally these 'passwords' aren't really passwords as such, but map back to a string of bits that control the state of the game - so it's more of a string representation of the current state of the game than a password.
There is an amazingly good description of how this works available here that covers the full process of mapping the provided 'password' ...