This suggests that their sanitization practices are not very targeted. In particular, you should never have to sanitize a password. Passwords should immediately be hashed and only the hash should ever be stored. As a result SQLi via password field should be impossible.
Now normally defense in depth suggests taking extra steps for security is a good thing, even if it seems redundant. So a naive answer would be "they are being careful about security here, even if it is potentially unnecessary, so what's the problem?". The problem is that unnecessarily removing characters from passwords (presuming it didn't actually break anything) makes the passwords weaker. If their system properly "cleaned" the input both when the password was stored and when the user logged in, then the login would work normally but a password of "my--password" would presumably turn into "mypassword" before hashing. As a result, the cleaned password is more crackable than the original.
The other issue is that the way they worded it suggests that they have a sanitization script that just blindly "cleans" everything. This is really the lazy man's way to do security. I've seen plenty of systems that use that approach, and in my experience it usually means that the rest of the security isn't really well thought out.
Finally, it really is a useless security measure, and steps which make things look good without actually improving security don't help anyone. The reason why they are removing a double dash is because in SQL this is a comment, and as a result it is sometimes used as part of an SQL Injection attack. Stripping out the comment characters isn't a very effective method for defeating said SQLi attack. They need to reject such requests all together. They also better be using prepared statements properly, in which case stripping out double dashes is doubly useless.
It is certainly no excuse for a bug: that just means that they failed to properly implement a less-than-ideal security feature. Hopefully they made that comment to you as a "thanks for pointing out this bug so we can fix it". Even if they want to keep their "cleaning" algorithm, it shouldn't break anything.