Remark 1 : LS core already save SMTP password in clear text in DB
Remark 2 : Plugin passwoird is shown in HTML flow : this is the bug , not save in DB

Remark 3 : plugin are allowed to extend getPluginSettings and saveSettings
https://github.com/LimeSurvey/LimeSurvey/blob/master/application/libraries/PluginManager/PluginBase.php#L98
https://github.com/LimeSurvey/LimeSurvey/blob/master/application/libraries/PluginManager/PluginBase.php#L190
Then YOUR plugin can crypt the password the way the plugin want, and not core want.

Think it's more a feature request.

Note: There is no truly secure way for storing the password.

However we can apply encryption to protect from a DB only breach.

1. We have an encryption password (something that is unique for each installation and not stored in the database.
2. We encrypt the password using that encryption key, before storing it.
3. We decrypt the password upon fetching it.

Notes:

• The plugin developer can choose whether or not to serve the saved (decrypted) password as a default / current value, that is not up to us.
• In case both the filesystem and database are breached this offers no protection.
• We can't use hashing here since the password needs to be available in cleartext for use by the plugin.

Move to feature , and question is

• Did LS must crypt the password of plugin by default or not.

I think i add a options encryt=>true/false :)
And then add the default behaviour for saving :)