While only the maker of a device can give you the canonical answer about that device, there are a few factors that generally explain why only PAP is supported on many platforms:
- PAP is old (RFC 1334 was published in 1992) so it used to be pretty much the only standardized choice. Even after newer (and arguably better) standards were released (such as CHAP in 1996 and EAP in 1998 with updates in 2004), companies could still use the already-written PAP code in existing products and just move it to their new products.
- PAP is easy to implement - no need to understand complex encryption mechanisms.
- There is an easy way to add another layer of security, so there is no incentive to fix it. (See final paragraph below)
In truth though, PAP as used by RADIUS does not actually send the password in plaintext. Instead, it XORs the password with an MD5 hash based on a shared secret. While this is also considered to be insecure, it is still at least a little better than actual plaintext.
The best practical answer for safe use of PAP is to tunnel the RADIUS traffic through a VPN (IPSec tunnel or similar). This is becoming standard practice when dealing with RADIUS connections anyway, as there could also be other sensitive user data besides the password that has to be secured.