Sure, encrypting the passwords is better, but to steal all the stored unencrypted password the attacker would need access to the users computer. If they have t

Sure, encrypting the passwords is better, but to steal all the stored unencrypted password the attacker would need access to the users computer. If they have that access you have bigger problems on your hand. Yes, this can lead to privilege escalation, but for the vast majority of people access to the desktop is enough for that anyway. If you need better security, you probably already are using more advanced measures.