I'm not sure where you got the idea that password dialogs will be called on the vfs thread. That is not true in general. For async vfs calls the password callbacks will be proxied to the main thread. For sync calls they will be called on the thread that did the call. If you're doing this in a thread and use gnome authentication manager you better enable threads.

However, there is one general problems with locking wrt sync calls on non-main threads. the callbacks can't take the GDK lock, because that would deadlock in the normal case of app doing a sync vfs call in the ui code. But this means that if you do a sync vfs call in another thread you either have to temporary or permanently disable the auth manager or get the GDK lock while doing sync i/o.

But is this something that should be fixed in libgnomeui or at some other level?

Not planned to be implemented as libgnomeui (and gnome-auth) is dead.