Not necessarily true.

In the health insurance industry, for example, many insurance portals offer one account that has to be used by a team. And, in a team scenario where all staff need access to all third party vendor accounts, it can be simpler to share the one password rather than manage 10.

For on site systems under a company's control, they can enforce the policies. But third party resources are where the limitations are. It's not the company that's minimal on security hygiene, it's the non-tech vendor in many cases.

There’s also a difference between password sharing and shared secrets. Sometimes you need something that is like a password, and needs to be shared amongst a team.

One example would be an inter-company IPSec VPN PSK.