How can passwords be eavesdropped at the point of entry, and why doesn't encryption on the network help against that?

Hardware keyloggers between keyboard and computer, keyloggers disguised as USB sticks, hidden cameras (even in a car-key fob) and simple observation capture the password as it is typed, before any encryption can protect it.

TLS protects the password on its way to the server. It does nothing at the keyboard:

• Hardware keyloggers: a small adapter plugged between the keyboard cable and the computer records every keystroke. Some send their log over Wi-Fi. No software is involved, so antivirus cannot see it.
• Fake USB devices: a "memory stick" that is really a keylogger or a malicious keyboard.
• Cameras and observation: a spy camera in a key fob, a camera above an ATM, or a person looking over the shoulder (shoulder surfing).
• Software keyloggers: malware on the endpoint that reads keystrokes or screen contents.

The lesson is about the authenticator, not only about hygiene: any authenticator whose output is the same as its secret is defeated once the input is observed. Authenticators that compute a fresh output (OTP, challenge-response) or keep the secret inside hardware turn a captured value into something worthless, and a second factor means the observed password alone is not enough.

Go deeper:

• Keystroke logging (Wikipedia) — software and hardware keyloggers and the countermeasures against them.
• Shoulder surfing (Wikipedia) — observation attacks on PINs and passwords.