How is it legal for an employer to demand an applicant's social media passwords?

[laughter_every_day]

Jack has no right to the job and he can choose to apply for the job or not, and to furnish the info or not.
When you give some written comments to Jack, you have no privacy rights and Jack can share your comments with the entire world.

[E-ma]

You answered it in your question. It's legal b/c it's not illegal.

Might I suggest Jack change his public search settings to private so the employer cannot find him by searching his name.
Then create a Linkdn acct.
Deny he has a FB acct. b/c he doesn't have time for mindless social media.
Yet he will gladly provide then with his professional Linkdn acct. password.

Or he could deny having one & merely ask, "Is it an employee requirement that I make an acct.? B/c I will if you need me too & then give you that password." He can create an acct. including or ommitting his middle name (if his current one is with or without it).

With millions of users, there is always someone else with an acct. that matches your name. Mine is a rare name & there are still a few others out there.
If enough people start doing this, it will no longer become as effective for employers.