@WarnerCrocker in some cases like Apples ‘not quite 2FA standard non ADP ecosystem, ‘law enforcement’ would have to provide a court order or subpoena.
Companies and users have to deal with password issues much much more than the nosy need access often for nefarious rather than legitimate purposes.