Many of the home router vendors have released firmware with stupid flaws like allowing the inbuilt webserver (running as root) to traverse up directories and thus allow the attacker to view config files.
If the passwords were stored properly hashed then the attacker has to do a lot more work to recover the plain text.
That said, I'd say if you have user privileges in my router, I've bigger issues than wifi passwords and config files...