Zero-sum Security: Zero Trust is Compromised as Long as Passwords Remain