I don't think I've ever respected just how dangerous Data could be.

That depends on the system and whether it immediately responds to the challenge with a failure or locks out after a number of incorrect responses.

If LCARS is programmed to just immediately respond that the password is wrong then the real password could probably be brute force guessed in a matter of seconds given the computers in the 24th century...