Keycloak is designed with security best practices:

Passwords are never exposed or checked via standalone APIs
Authentication is always done via OAuth2/OpenID Connect flows
Prevents misuse like brute-force password checking APIs