During my new grad interview there I was made privy to some very questionable security decisions that they mentioned linked to PCI-DSS, but nothing on this leve

During my new grad interview there I was made privy to some very questionable security decisions that they mentioned linked to PCI-DSS, but nothing on this level. Edit: PCI compliance rules out plaintext storage so it seems unlikely. It's worth noting that plaintext storage might not be the case if they store the fourth and only the fourth character separately at encryption time.