Most users stick to plaintext. That's expected. Under typical threat models, convenience & ease of use outweigh perfect security.