Isn't it more likely that they use some social engineering trick to harvest the passwords?

I don't think they even store iTunes password on iOS, because you're asked for the password every time you make a purchase. Well it'll 'cache' it for 5-10 minutes for convenience, but past that period then it'll reask you for the password to be resubmitted over the net for reauthentication.

Keylogger is also unlikely due to iOS' sandboxing lockdown.