In a different campaign, perhaps not.
However, in this campaign, a precedent has been set regarding the general ineptitude of villains and carrying important pieces of paper around on their person.
In other words...
If this were a different campaign, I'd say, "No one is stupid enough to carry the password on themselves when they know there's a chance of them dying/being captured." In this campaign, I can't say that. It turned out that this villain wasn't that stupid, but there existed a strong enough possibility that the search was worth the risk.