VNC does not pass clear text passwords, but neither does it encrypt data transport. Personally, I don't think that is such a big deal, since the data is mostly display information (PDF for OS X). Of course, any text, including passwords, you type in will pass as well.
You can ssh port forward VNC. Then your transport and all your data is encrypted.
