When you’re using vger hosted on a different domain, your password has to be read by them and sent to the Lemmy server to log you in.

If it’s on the same server, the pw stays in the one system (albeit it might still need to go through the two pieces of software, idk how it’s configured).