After a bit of consideration, I am guessing that if they used a legitimate WPA2 outward facing, then the credentials you sent would not be in clear text. Embarrassingly enough, I'm not 100% sure on if they could just get the encryption key and decipher your password then. Another thought is that if it was real WPA2 security, you wouldn't actually gain access to the network (or the wireless connection mgr on the os would give a warning), which would be cause for suspicion, prompting you to change pw/ inspect your network
In theory, that doesn't matter if they can get a hold of your credentials. I'd imagine that there is some differences in how they may design the attack based on if they,re using a HostAP , vs a real wireless access point. Each of these options is going to have a different dataflow, so they're going to plan for whatever gets your credentials most easily.
I think the real advantage of a captive portal, is that it's a low effort way to confirm that the victim is gullible, and get credentials in clear text, directly to a web server, rather than into an AP, where they may have more trouble either getting at the creds, or unencrypting them. From there since you're already connected to their AP, if you're still using the connection they can monitor your traffic and extract more in clear text, or frankly they can have a baseline for trying to unencrypt any credentials you send over a secure connection. This is far flung, but they can run a brute force decryption on anything you send, like a bank account login, and enrich that with a known password of yours (wifi password), basically making a more intelligent guess as to what the encrypted pw is.