This question already has an answer here:
Sending plain text passwords over https is quite secure, the traffic is encrypted, making eavesdropping virtually impossible.
However, once on the server side, it is still plain text. Of course, storing the passwords needs proper encryption, etc. But how about monitoring tools, logging, etc.? Isn't it possible that plain text passwords end up in logs, etc? Even when using POST?
If we'd monitor the communication, we'd also see the passwords in plain text. A simple digest instead of plain text would make it harder for us to see and remember it. Yes, I can access a lot of sensitive data anyway. Yes, I can use rainbow tables to decrypt the MD5 hash. If we want to do bad, we can do bad. But why should we allow the possibility for me and colleagues to see plain text passwords?
Since people tend to use the same password for multiple online services, having someones password gives access to more that just our data of that person.