Of the systems and sites which have been developed recently, there are two main reasons why any company would store passwords in un-hashed and -salted plaintext.
Option 1: They didn't think about it when creating the storage medium. As has been seen often in the past, security (both computer and otherwise) isn't something people think about until they feel they need it. In some parts of the world, people leave their front doors unlocked, and their neighbours will come over and make themselves a cup of tea whilst they wait for the owner to come back. Only once they have something stolen do they rethink that plan. Similarly, how many times have you used, or seen someone else using, an insecure password to access something... like your date of birth or 1234 for your credit card PIN, "password" for a website, etc? It's the same as closing your front door but not locking it. Fine, until someone malicious wants to gain access.
Option 2: They thought about it, and decided they didn't need it. I've seen companies say "If we have a site which stores no personal information, does not handle any monetary transactions, and otherwise has nothing of value, then there is no real issue with not having security, is there?". Unfortunately they are always wrong in this for one reason, and sometimes for a second also. The first is that people reuse passwords. If they have the same password on this unsecure storage medium as they do for their email or banking, they have a problem. Although not the company's responsibility, it's a small thing they could do to help the security field as a whole. The second reason this is wrong is that things of no actual value often have perceived value. Take for example your reputation - often internet forums are completely anonymous, and hold no personal information about the user. If someone else could access your account and make disparaging remarks about others, the reputation of your digital identity would be harmed, even though you have not lost anything with any actual quantifiable value.
In simple terms, security is something often bolted on at the end of any software development lifecycle, rather than thought about carefully from the ground up. Many systems will have the "secure" method of salted and hashed passwords added into the system shortly before release to testing. Although it's good they have it in, there's flaws with this way of thinking, as the rest of the system may have vulnerabilities which preclude the security steps they have taken from being of any use. The NTLM authentication for Windows is an example. This hashed password is very effectively protected against brute-force attacks, however if the system still has the old LM password hash (for the same password) stored alongside the better method, you can dramatically reduce the time needed to break the NTLM password hash by first breaking the LM password hash.
Even people who should know better are storing passwords in plaintext. Whenever you get an email confirmation from a website you've signed up and they tell you what password you've used, my recommendation is to delete your account immediately. One fine example of this until a couple of years ago was none other than the British Computing Society (who should certainly know better!)
