"The user doesn't own their password." I'm honestly curious about the precedence in court cases that lead to this conclusion. I'm not challenging your lawyer; merely ignorant of the precedent, and have seen precedents leading to contradictory legal opinions, namely in law enforcement (failing in) obtaining warrants to compel users and platform owners (Apple Inc) of phones to reveal their codes to unlock devices.

And... I wonder if the lawyer has fully contemplated the implications of plausible deniability... That is, a user's actions on the platform can be positively applied to that person as a legal entity. If an admin can log in as that user, then the person's responsibility can be summed up as "I didn't do that; must've been MJHd logging in as me, since they had my password, too." (Are YOU prepared to take that responsibility? If a malicious user blamed you for their actions, could you be jailed?)

A recurring theme on workplace.SE is that your company's legal and HR departments don't represent you; they represent the company. If your manager is doing things that can get your company into a tough legal situation, then legal and HR are your best friends... If not... well...

Just... be careful. We care for you as a person. There are too many developers who have good intentions who get caught between a lawsuit and a hard place. Dot your Ts and cross your Is... and read the NIST authentication standards very thoroughly. You never want to know any passwords, and you want to make it as hard as possible for you to ever learn a user's password.

Just as a general comment for those saying that they do not understand how he can use bcrypt and still have the same default password. He might just store the encrypted password for all users as a default, instead of encoding it each time.