Not to mention that 37signals accounts are paid for - so there's a much higher incentive for people who forget their password to go through the flow to recover that account - otherwise they'll be wasting their money!
Worse, systems like yours usually ask for a new password when you log in again, but complain when the user supplies "password" or "letmein" because it doesn't have enough @ signs. And then it complains again when the user picks a password he's used before.
Maybe that's fine if you're a bank (though all it does is shift the plain-text password storage from your database to a sticky note on the front of your user's monitor), but if your site is just another URL shortener or whatever, I simply don't care how you store my password provided you can give it back to me intact when I ask for it.
For my own projects I don't set any limits on passwords that people enter - if they want to use an insecure password that's their problem.
A password that they can remember beats a password written on their monitor, even if it's not that strong.
edit: not that this is the best way to go (see other comments) but it's still miles better than what they have now, with minimal intrusion for their users.
There are costs to absolutely everything, even doing the hashed password in the DB trick.
Specifically, it puts one more bar in front of people logging into their account, particularly for some users who are habitually incapable of remembering their passwords and use the remember password link every single freaking time. (These people exist. Everyone collects stats, right?) You all know the conversion rate dieoff that happens as you add each additional form element to a checkout or survey form, right? And how increasing any funnel by a webpage increases the failure rate of the funnel, right? Well, imagine the equivalent of both adding an extra form element and an extra web access, right in the middle of the funnel, and if the user fails to get through the funnel they don't just bounce, they stop using your service for good.
At 37Signals scales, losing half of the 10% or so of accounts which might need password recovery is worth a lot of money. At least several tens of thousands a year. That is an awfully big price to pay as the insurance premium against someone getting a full compromise of their database. (Though I'm sure their users would be grateful if the insurance worked. "Well, sucks that an unknown hacker has a tarball of all the business contacts I've ever put in your database. On the other hand, at least you didn't compromise my password -- my gmail remains safe!")