So far I know we can set multiple users with their specific and unique passwords on node-red to increase security, and that each users access mode can be defined as "write and read" and "only read".
But what I am seeking is to have passwords on each flow, each flow would have it's own unique password, so only people with access to that specific flow would be able to access it.
Is this doable? if it is, can it be done without modifying the core components of the node-red? or one should modify parts of the program to achieve this?
No, it is not possible.
Node-RED is not multi-user/multi-tenant environment, there is no way to limit access to only parts of a flow (in this case the flow is the whole "program" running, all tabs).
And any change to try and implement it in a secure way would require a huge amount of re-writing of the platform.
If you want real user separation then each user should have their own instance of Node-RED.