The 'show password' option is a feature designed for better user experience. This started getting popular with the recent rise in numbers of mobile devices. The small on screen keyboards are notoriously difficult to type with, and when you are unable to see your input it can make it difficult to be sure the password was typed correctly.
I am not sure of any attacks that target readable password fields. In my opinion, if you have malware on your computer that can see your screen, then its quite probable they are capturing your keystrokes as well.
Is it a risk? Yes. This should never be the default behavior, but if a user feels they are comfortable displaying their password (secure in their physical envirioment), then I see no problem with this practice.
This is just my opinion, not a rule.