You have right, because the password field is a Joomla core field.
You can use the override language(Extensions->Language Manager->Override) with this constants:
COM_JSN_PROFILE_PASSWORD1_LABEL (label of passoword)
COM_JSN_PROFILE_PASSWORD2_LABEL (label of confirm password)
COM_USERS_PROFILE_PASSWORD1_MESSAGE (description of first password label)
COM_USERS_PROFILE_PASSWORD2_DESC (description of confirm password label)
The descriptions are inherit from com_users.
I honestly do not remember why we chose so
but for compatibility problems will remain so.