If they store the salted hash of your password but store the answers to security questions as plain text, then your advice is very bad. The db doesn't have to

If they store the salted hash of your password but store the answers to security questions as plain text, then your advice is very bad. The db doesn't have to get pwned even, employees of the company will see it