The more pressing question is why plain text authentication, or even a plain text listener was configured to begin with, in 2026 (really, 2016, being generous). STARTTLS is not a valid reason.