Short answer: Yes.
In the "olden days", it was possible to effectively prevent any other X application from reading a specific input by grabbing it. While this can still be done to this day, the XI2 protocol specification seems to suggest that this can't be done any more (see the description of Raw Events around line 2220). Thus under X alone you are not safe any more - at least not in the usual simple setups. See also the discussion under my answer to How to let a daemon prompt for a password (in Xsession, keyloggersafe)? and the AskUbuntu Q&A referenced there. Needless to say, no terminals are actually doing that - which is why applications like OpenSSH or GnuPG come with their own UI helpers, that grab keyboard (although as mentioned above, it doesn't really help that much these days).
What you could do though would be running an application under a different X server, e.g. a nested X server like
Xnest, or VNC based one like
Xvnc. Wayland protocol should also provide some protection against eavesdropping.
Apart from the above, the application could have also tried to exploit an unpatched security hole in your system and thus gain elevated privileges. Or do something easier, like putting a
sudo wrappers into your path before the system ones and thus intercepting the passwords (thanks @Joshua for the comment).