In any instance of a vulnerability, adversarial thinking helps. In what scenario would I find this vulnerability helpful, if I maliciously wanted access to someone's account?
Well, as a sysadmin, I have access to everyone's password hash, along with any salt and pepper. But, because they are hashes, I still cannot crack a password which is well chosen. I am not the only sysadmin, so I cannot install tools to password snoop and guarantee that they will not be detected.
But the user has typed in their password, and left it with asterisks there. If they have walked away from the computer, while leaving themselves logged in, there are any number of things I can do to recover the password. But they have not. They have, instead, called me over to help with a problem they are having with their browser, keyboard, mouse, whatever.
Under the guise of testing, I can click around, click their username, select text on the page, hit tab, the password field is selected, ctrl and the cursors... or I can log in myself, type my username into the name field, click on the end of the password field, move my cursor to the beginning in a natural-seeming way...
...a fraction of a second, and I've established that their password is of the form "aaaa??aa", and my task of cracking their hash has become vastly easier, because I only need to test that pattern space. Assuming they could use any character on a keyboard, my problem space has reduced from 94^8 = 6*10^15 possibilities, to merely 62^4*62^2*32^2 = 5*10^13.
Which is already a hundredfold improvement, which allows a much wider range of attack patterns; but more importantly, I can tailor my attack to try things which are likely to work first: all four letter words from my dictionaries; then two arbitrary special characters, likely a repeat, or a punct and space; then two characters, most likely numbers, especially if we require numbers in our password policy.
So yeah - it can be done in their face by a support tech, and leaves no trace that a skilled user or other support techs might discover, such as those left by keyloggers or rootkits.
[Edit: I just realized there's also the possibility of it being "????xx??" with that pattern - but that is only 32^6*62^2 = 2*10^12, within possibility for brute forcing.]
[Edit2: I picked xxxx..xx as an example of where it would be good to know, but let's consider the worst case 8-character pass: xxxxxxxx. That's dropped the attack profile from 94^8 to 32^8+62^8, or 2*10^14, which is still a 30-fold reduction. Longer passwords give better reductions, of course, but are still harder to crack. But not only that, I will be able to strip a whole load of rulesets from my attack profile, so if the password is in any way non-random, I'll hit it that much earlier.]