Baffour,
Do they allow their own layers to be added to an organizational webmap of which the public has access?
yes, for most map services.
Do they have a way to work around that without asking for a password from the public?
They should not be asking for log in unless the data is not properly shared with the public.
Have you experience that before?
No, unless you are using your orgs url and not the public www.arcgis.com url as explained in the link provided earlier or the map service is not public.