I believe the article is referring to the plaintext transmission of credentials (your browser --> their server) which can be intercepted, rather than the plaint

I believe the article is referring to the plaintext transmission of credentials (your browser --> their server) which can be intercepted, rather than the plaintext storage of credentials (their server --> their database). Both are problematic.