On the face of it, PTO seems like a good idea in educating people about password security.
On the other hand, if I were an attacker, PTO would be the first place I would start if I wanted to start collecting a list of plaintext passwords.
Knowing that example.com is a plaintext offender doesn't help me much in mass-compromising accounts for that website. I could try to compromise their peering-router to sniff all their outgoing emails, but that would be quite difficult, because that router is likely to be properly secured. Trying to attack their website itself is likely more promising.
The more plausible attack scenarios which become possible through plaintext offenders target the individual user and all websites they use, not all users of the individual service. When an attacker could read the mail communication of a private user (much more plausible than with a professionally administrated system), they can obtain their login credentials for all plaintext-offending services they register to. That means an attacker would rather be interested in finding vulnerable users so they can get logins for random websites, not finding a vulnerable website to get logins from random users.
Besides, finding out which sites are PTOs is trivial: You just have to register an account and you know. Fully automatic account registration is something spammers got frighteningly efficient at.
This is the usual vulnerability disclosure debate: when you find a vulnerability, what do you do with it ? Bringing it to the public view right away can be considered as "helping the attackers"; however, discussing it in private with the affected systems' operators or vendors can turn unpleasant; in particular, some vendors or server owners are prone to consider any such private warning as an attempt at extortion, and call the cops.
Some security researchers want money out of their work; many others want fame; quite a few want both. Publishing the security issue immediately is of questionable responsibility, but is "safer" for the researcher and has the highest probability of bringing fame (and the lowest probability of bringing money).
Compounding the issue is the idea that a "plaintext offender" is a site designed and managed by people with only cursory knowledge of information security; therefore, they cannot be expected to react with the technical alacrity and mutual respect that would be most liable to induce an happy outcome (researcher gets the money and the fame, vulnerability is fixed, the server owner appears as a good and efficient manager of security issues). From the point of view of an honest researcher, such sites look like trouble. You can have a quiet technical chat with Google or Microsoft; with a site that stores plaintext passwords (and, more often than not, sends them by email !), drama is a definite possibility.
As others have noted, storing passwords in plaintext does not really make attacks more likely; they make them more devastating when they occur. The targets are not easier, but juicier. In that sense, PTO does not really help attackers.
(The overall strategy of PTO is to become known enough to the general public to be able to exert some pressure on site owners, ultimately resulting in a safer Web altogether. That's education through point-and-shame -- it should theoretically work in a capitalist free market, customers being the ultimate force. However, I don't see PTO as having achieved that level of fame yet, by a long shot. They need a logo, a cleaner Web site, promotional videos, and endorsement by George Clooney, at least.)
I agree with the notion that all knowledge can be used for both good and evil but in the case of PTO I honestly believe their main goal is to "shame" sites that store user passwords in plain text and thereby put the users at a security risk.
As they mention on the site, even if the user was smart enough and created the strongest password possible, if the website stores it in plain text or uses easily reversible encryption then it's vulnerable.
I think it's about educating people about password security but also criticizing or shaming websites that don't take the necessary precautions to protect their user's account information.