Worse. I don’t like her sending the info to her own yahoo account that could be accessed by anyone she chose to give the password to who might be an agent for an entity not friendly to the US. Like her relatives.
Password or not, if you send email without encrypting it, any hacker can access it.