That would be the expected behaviour if that container has been running without interruption during all that time. As an update requires a restart, that would be when a new random password from %randomAdminPassword%
would have been set.
Yes.
As mentioned before, use the WEBPASSWORD
environment variable for a dockered Pi-hole.