[jasonjayr]

Sure they are small little embedded chips, supposedly physically hardened from tampering.

but argon2($string_of_any_length) should produce a fixed-length byte string, no?

[LawTalkingGuy]

And if they aren't using such a password library, what other errors are likely?

Timing attack on the character of the pw which failed?