Remove unnecessary WTFs from password state check

It is possible to have null PasswordMetrics object for a given user -
if, for example, the user never had a password set.

Do not WTF in that case.

Bug: 78191197
Test: That it compiles.
Change-Id: I807c2755890b0772e295b4cb0095cac1bf2d0aef