With SyncNow the agent never receives the password: it works under a short-lived capability limited to one project and its work session, while the FTP and database passwords stay in the SyncNow vault.
Every write also gets checks that a plain FTP client does not make. A file that changed after the agent read it is refused with STALE_CONTEXT instead of being overwritten, a PHP file that would break the syntax is not written, and earlier versions of overwritten files are usually kept on the SyncNow server, so restore_version can put one back. FTP logins are paced too, to avoid the temporary bans some hostings apply after too many connections.
Each session is recorded in the project's Activity with the team member it worked for, the agent, the objective and the files changed. And a capability stops working when its session ends, so an agent cannot keep using it afterwards or pass on a password it never had.