I manage a vendor app that issues accounts (with passwords, of course) to end users. From what I can see, final user passwords are stored properly. My concern is the initial account generation and communication step. The first point of contact with end users often isn't over the web — it's just as likely to be by phone, mail, or other means — and so the app has many options for communicating the initial account credentials to end users. To facilitate this feature, the app stores the initial password in a database column in plain-text that can be used for generating letters, welcome packets, email, shown on screen for communicating over the phone, integrated with other software systems, etc.
There is a mitigating factor here. The end user must change this password before they can complete their first login. The changed password is not written back to the database in plain text, and is not stored in a recoverable format. The original password is only good for at most a few weeks before it is changed. Additionally, the end user can't do anything with a new account that couldn't be rolled back if needed. It may be possible to leak some personal information, but I believe a new account won't display any data yet that isn't considered directory information.
However, it still nags at me that this plain-text password exists at all, and hangs around even after it's replaced. Given the mitigating factors, is this still a big deal?