I think the source of your confusion is that you are wondering how to log passwords "on Linux". However, this isn't really about Linux (although the system in question is likely running a variant of Linux).
Linux, Servers, and Protocols
The thing to remember is that SSH is simply a protocol. An actual application is required to allow SSH connections to a server. There are any number of applications that implement an SSH server, and all of those can and do behave differently, even if they present the same general interface to the end user. Compare for instance openSSH (probably the most common ssh server used in Linux) and dropbearSSH (to pick a random alternative). My point here is that it isn't "Linux" that you connect to when you open an ssh connection. Rather, it is some application that is running on the OS that is implementing the SSH protocol.
Since the user's password is required to log them in, the SSH server certainly knows what it is. This is no different than (for instance) the fact that Facebook has access to your password when you first log in, even if it doesn't keep that password laying around (well, they're not supposed to anyway....). Since SSH is a standard protocol, any application could open up a socket server on a port on a machine, listen for incoming SSH connections, and respond however they want. Normal SSH applications (such as openSSH) will refuse to log passwords to protect user security, but that is a choice that the openSSH developers made, and it is not a general requirement for SSH servers.
This brings us to the question at hand, which are honeypots. A honeypot is a specific security measure where you operate a fake service that looks like a nice and juicy target that would be of interest to hackers/scanners. You deploy them in such a way that normal users wouldn't find them or interact with them.
Since the people in question are operating a server that is intentionally meant to attract hackers and scanners, it is not running your typical SSH server. Instead it is running a completely different kind of server that accepts incoming connections, negotiates the login process normally, logs the attacker's information (including passwords), and then either disconnects the attacker or dumps them into a fake shell that doesn't grant actual access.
Since the "Honeypot as a service" is running their own SSH server, they can easily have it record the user's password, since the SSH protocol has to send the user's password to the server anyway.