Using 20201010.0 passwords are echoed even if --protect-prompt is set. Does work with version 20190914.0.
System: Debian 10.6 (Buster), always reproducable:

$ swaks --protect-prompt --from [email protected] --to [email protected] --au username
Password: SECRET (expected: ******)

(Obvoius note: This is a security problem)