It happens all too often that a database containing usernames, email addresses, personal information, & passwords gets stolen or hacked.
If a malicious user obtains an email address (or other personal information) and password it may very well be possible for them to steal a person's identity, destroy a reputation, hijack online accounts, etc. There are countless cases of this happening online every year.
It should be required that an Internet-based login system be forbidden from storing passwords in plaintext or with reversible encryption, unless certain compliance measures have first been satisfied (similar to PCI compliance).
Passwords should only be stored after they have been salted and hashed using a cryptographically secure password hashing function, e.g., PBKDF2, and salt.