The point is that we don't know which 3rd party clients could steal your password.
These are the criteria you would need to meet to be able to trust a 3d party client:
1. Its code is completely open source
2. You have reviewed every single change done to the client to make sure it has no malicious code
3. You compile from the source code yourself, because any executables they upload could have something in it that wasn't shown in the source code.