So I stumbled upon this handy chart:
Which cured my head-scratching over why I couldn’t see a recovery password for certain devices. Not all Active Sync clients support it. In fact, most don’t.
Could be useful to keep in mind when deciding company policy.