When building a CustomizationSpec for a VirtualMachineCloneSpec one of the options is encryptionKey which is used to encrypt passwords in the customization spec.
The value of encryptionKey is a property of the CustomizationSpecManager
It is unclear at this point what algorithm is used to encrypt the passwords so some investigation is necessary.