I sympathize with the developers because I face this maddening argument every day between convenience and security, but storing passwords in plaintext on local. Geez.

Make a token on the server after initial login and store that! Not much more secure, but then this story wouldn't be news.