No. You never need your client's Facebook password, and they don't need to create anything from their own profile.

Here is how it works:

  1. Ad account: you create it yourself, inside one of your BMs that still has a free slot (a BM has an ad account limit), or by opening a new BM for this client.
  2. Facebook Page: you create the company's Page, or connect one that already exists.
  3. Instagram: this is the only step where the client comes in: they sign in to their own Instagram account to authorize linking it to the Facebook Page (you don't need their password). It's the only step that depends on them.
  4. Payment: add a card, or generate a Pix payment (Brazil's instant payment method) in the ad account to add funds, and your campaigns can run.

In other words, a client without a Facebook password doesn't block anything. You set everything up and leave only the Instagram link for when the client can authorize it.