I'm pretty sure, that the same happens if you clone a Windows Host.

Idea 1 to "solve" the problem:
Remove the password while cloning a windows hostgroup / host. Drawbacks: for Hostgroup, the root_pass will then be empty because it can be empty and the user will not forced to enter a new password.

Idea 2:
Add a prefix for Base64 and Base64 like "B64:<real password>" which will be stored in the DB. While reading and using the password, the prefix will be removed
Drawback: migrate the data.

Idea 1:
I guess if we do this, we would have to do it always and not just for Windows-Host(group)s. Otherwise we have a different behaviour that is in no way communicated to the user (unless they llok at the root_pass field).

Idea 2:
Could we use the crypt-syntax for that: https://en.wikipedia.org/wiki/Crypt_(C)#Key_derivation_functions_supported_by_crypt
It would have the benefit, that we already detect that for the *NIX operating-systems.
Unfortunately, there is no schema there for Base64 or Base64-Windows, so we would have to 'define' one.