by James Wassink.
I created a small test table with plain text passwords and it worked for that, so it may be the SHA-256 which is breaking it.
And I can confirm that passwords are not copied by default, although the password field in the moodle user database for the new external users is not blank - it says "not cached".