In the context of ssh, "credentials" can have two meanings.
It is true, that registering cleartext password as cleartext, i.e. without any encryption or so, is at least a bad practice from a security view. However, encrypting them correctly is simply impossible: Putty somehow needs to access them on authenticating with the remote server. To do that, it would need to decrypt it. It does not matter, how would it be done, the same could be done also by a potential attacker. Encrypting the password would be security through obscurity, thus it would have not a very much security gain.
Although using same encryption, or using an improved ssh protocol which somehow circumvents it, would be obviously better, the difference is not so huge, as it seems on the first spot.
Public/private key pair
The public key can be sent to anywhere, the private should be kept secret. For private key, the case is the same in this context, as for the password: if someone can read out the private key, can also manipulate the Putty process to extract it for him.
The most important thing to know: to get the credentials, requires access to the client machine (either as an admin account, or account to the user). Having this access, even an encrypted password could be eavesdropped, for example by using a keylogger, or by binary hacking your Putty process.
It is an inherent security weakness of all password or key-based authentication system. The only solution for that, if the authentication happens on a different channel, by a different system, from which the connection was initiated. The are multiple solutions for this, multi-factor authentication or Kerberos. Most ssh software (including putty and the openssh server) supports the second, although it is rarely used in the daily practice.
The daily practice is to not allowing physical access to anybody to your client machine. If they have access, they can access much more than only your ssh keys/passwords.
The same stays for Kitty. It might not keep cleartext password or keys in the registry, but it still needs to get somehow access to your passwords/keys. Even if it store on a lesser public way, what Kitty does to decrypt/access them, also a malware can do (or a modified Kitty binary can do). Thus, Kitty increases the security of your system only a little bit. But it might give the false sense of security, what could be even dangerous.