Who would have thought, that if you let your software to remember your password and use it automatically, it must store it somewhere?

The criticism of not using the Windows API for storing secrets is valid, though, but it still does not help if you, and the malware you run, are logged in.