Block overview course filter displays hidden custom fields

When selecting a password field type as a filter on the block overview section. It exposes all possible passwords and filter by them, so they are matched to the courses. Check screenshots.

Update: Based on discussion below, this issue is only scoped with fixing the display of hidden course custom fields. When hidden (visibility not set to 'Anyone'), a course custom field should not be presented in the 'customfiltergrouping' admin setting, nor presented to users as a filter in the course overview block. The merits of password type custom fields can be discussed in MDL-67272.