While intercepting HTTPS using Burp and Burp's certificate is added to the browser, I intercepted a login request and the password shows as plaintext. Does this indicate a vulnerability or is it the expected behavior?
It's not a vulnerability.
Since the page transmits the password via HTTPS, it's encrypted before being sent on the network.
You allowed Burp to decrypt any encrypted traffic by adding their certificate into your trusted certificates store: that's the only reason why Burp is able to perform a man-in-the-middle attack and see the password in plaintext format.
Anyone else will only see encrypted traffic, and won't even be able to tell if a password is being transmitted.