Quick google led me to RFC4252[0], section 8 of which (as far as I understood) describes ssh auth sending password as UTF8 plaintext string (and the whole packet is encrypted at transport layer). While passwords in /etc/shadow are hashed, if someone got access to your server he can just put malicious listener that will catch this UTF8 string.
I'm not a SSH guru, so if I'm mistaken please shout at me ;D
[0] https://datatracker.ietf.org/doc/html/rfc4252#section-8
