Thanks for listing the steps to duplicate. It should be noted that you also need to ensure you have your WHM account configured to require a password strength (e.g. 60) when attempting to duplicate this behavior.
It looks like the API response from changing the account password is not in the same format as the other API responses that the module expects, so it was not handling that error. I've updated the module to handle that error for the next release. See CORE-1580.
It's entirely up to the module to determine what an error is with respect to the API it makes use of, and to then let Blesta know what it is, if any.
While cPanel generally displays friendly error messages, likely because the same message is shown in their account interfaces, error responses from the API can't always be parsed and sent to the view in Blesta. Some APIs don't return friendly messages (maybe just an error code #), or may contain sensitive information that should not be displayed in the public interface. The module should determine what the best error message response would be considering the information it has at hand and the fact that it will be displayed in the interface. This is why several extensions sometimes defer to generic error messages.
The cPanel error message for this particular password request can be confusing:
Sorry, the password you selected cannot be used because it is too weak and would be too easy to guess. Please select a password with strength rating of 60 or higher.
The second sentence tells the user to select a password with a strength of 60+. What is 60 and how is it determined? The module doesn't know, the user won't know, and even I don't know what would pass that requirement. It might make more sense in cPanel because they display a password strength indicator while you type in your password, but that strength indicator is not available over the API. It would likely be better for the module to translate this message into something more useful/generic because of this, such as "The password you selected was rejected. Please enter a longer password containing numbers, letters, and symbols." But I'll leave that as a feature for another day.