Not entirely accurate, even in California, and that is not what that penal code explicitly states. It has several clauses, but the relevant one is, "5. Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network."

If the device was a shared device which contained personal employee information, the employer is likewise forbidden from demanding passwords as well. This is a common situation in business nowadays, when employees will use their corporate issued device to bank, shop, etc. on, and the company takes it giving the employee time to delete their passwords.

It's not as simple as 'if you withhold a password, it's illegal.'