
Beautiful question @Trevor Chandler! In step 5, key pairs are generated only for public key authentication. If password authentication is used, key pair generation isn't necessary(step 4). Instead, the server verifies the password, and a session key is still negotiated to encrypt the communication. So, key pairs are used only in public key authentication, not in password-based methods.
ssh -L 8080:localhost:80 user@remote_server