> This is a networked service. You send your password (or a hashed form) to it

Hopefully neither. But given everybody involved in VNC seems to be the same batch of clueless morons who built all those PHP web forums twenty years ago with MD5 as the password hash, who knows what they cobbled together. Maybe an expert can chime in about what actually happens here?

Yes, for a sensible scheme this can't work.