Is this a safe practice?
No, absolutely not.
Unlike internet traffic over HTTPS, phone lines are not encrypyted. In theory, nothing is preventing HTTPS-style encryption, but the problem is that both devices need to be able to do that. Normal phones just can't do it. And unlike HTTPS, there is no single big solution that the whole world knows and accepts.
Note that GSM and later mobile phone protocols have some encryption, but a) it is not that secure, and b) in the usual case, the signal to the base station is encrypted, and then from the base station on it's plaintext again.
Also note that some few of the "big" lines between countries etc. are encrypted (ie. phone->telecom1 not encrypted, telecom1->telecom2 encrypted, telcom2->phone not encrypted), but sadly that's rather seldom.
What that means for practice? Either crack GSM, or more easy set up your own base station, or even more easy (but a bit dirty) dig a hole to get to a major transport cable. (Or, if you're a diva like some certain government agency who doesn't want to get dirty, ask the biggest phone/internet node on the continent to get own rooms in the network center.). Being a telecom employee is nice too....
The only positive aspect might be that most attackers focus on the internet and related devices (computers, mobile phones, ...), instead of old phone connections.
Specifically, is this less secure than inputting my password on their
As keypad buttons don't map 1:1 with ASCII characters
So what? Anyone listening for pressed phone keys knows that and can easily convert it