I hope they are talking about hashed passwords. There is no reason why in 2021 passwords can be recovered in clear text, even in a legacy code base...