I would love a PR for making the password visible. That would be awesome.
The username is a core part of Shield, but can also be adjusted. I would say adhere to the configuration of Shield. I did just take a look and realized we don't have any logic in the view to display/hide the field, based on setting('Auth.validFields') containing username or not. Then on save, if it doesn't want a username, save the username as the email address.