Thanks for all the details.
It should have behaved like this, but it didn't.
This bug has been added to the tracker:
https://winscp.net/tracker/1443
I'm sending you an email with a development version of WinSCP to the address you have used to register on this forum.
To correct this behavior would have when the pattern !P is present in Putty/Terminal client path (logically Remember session password and it pass it to Putty(SSH) is not checked)
then the password is sent (I hope in 5.9.1)
It should have behaved like this, but it didn't.
This bug has been added to the tracker:
https://winscp.net/tracker/1443
I'm sending you an email with a development version of WinSCP to the address you have used to register on this forum.