Many of the home router vendors have released firmware with stupid flaws like allowing the inbuilt webserver (running as root) to traverse up directories and thus allow the attacker to view config files.

If the passwords were stored properly hashed then the attacker has to do a lot more work to recover the plain text.