This question already has an answer here:
It seems like plaintextoffenders.com sees sending a plaintext recovery password as wrong. Instead, a link to set a password is better. But what's the difference? If a user follows a link and sets a password, or gets a password, logs on, and changes it, the danger seems the same. If someone intercepts the email between following the link or between logging on and changing the password - they can both impersonate the user.
To be clear, I'm referring to a new temporary password. Only password hashes (PBKDF2, scrypt, ...) are stored on the server.