If they are using plaintext passwords, I wouldnt be suprised their next step would be using MD5 or SHA1 or self made crypto...

This is exactly the place where good defaults and good tutorials are incredibly important. PHP is notorious for this mistake.

Or better, to stop using passwords altogether!

Unless the framework automatically does this, this will never stop. So many tech companies are really a guy who did a Udemy course or read a Dummies book.

I interned at a company that did 10 million a year with a website built with nothing but the w3schools tutorials. You could print the database from the login form as it was started by a guy who just read those tutorials.

We weren't allowed to fix it either as the owner didn't want a system he didn't understand.

It’s not just dumb people. All systems need good defaults to prevent security errors. The world’a most skilled c++ programmers collapse as soon as a fuzzer is thrown at them.