With just a tap, path displays user passwords in plaintext.

Well, no, not really.

Path doesn't display YOUR password in plaintext. It shows what you've typed in the password box unobfuscated if you tap the "?" in the password field.

Since the password masking field only shows the last character typed for a second or so, if you have a particularly complex password, sometimes rather than trying to type it in over and over again on a small keyboard, it might be nice to actually see, unmasked, what you typed into the field. For about two seconds.

I fail to see how this is any less secure than the masked field showing your password one character at a time as you type it.