Their concern is valid, but it's weird that they call it "in plain text". "Plain text" has a specific meaning of "unencrypted", whereas this is encrypted in a TLS connection. Yes, both TFA and the original heise.de article say (paraphrased) "Although it's in a TLS connection, it's in plain text." but it's just confusing to phrase it this way, especially since it becomes easy to remove the "Although it's in a TLS connection" clause, as you did in your quote.

Their objection is that the credentials are being transmitted to and stored by Microsoft at all, instead of Microsoft generating and storing an automation token / app password. That is a valid concern. But tacking on "in plain text" to it just creates confusion.