Nobody said their customer support rep would be the one doing the decrypting. All it would take is an 'email the user their password' function in the app that decrypts the password and sends out the email.

I think you're misunderstanding their argument.