That doesn't necessarily mean that it's in plaintext. It could just be a 2-way encryption algorithm. That's what I did for my Twitter app pre-OAuth. That way, the passes are encrypted, but I could still decode them to send them to Twitter.
Now, the way I did it, at least, the key for decrypting it was in my code, so if someone hacked, there's a good chance that they would look through the code and figure out what the algorithm was and what the code was.
Still, if they just took the db and got out, and I fixed the hole before they realized it and came back, they would have a very hard time getting the passes.
37signals might be doing something like that, which is better than nothing. Now, they have no reason not to use a 1-way encryption algorithm, so it's still less secure than it should be.
Why go through the trouble of a "2-way" encryption scheme which, as you point out, could easily be compromised by someone with access to the server, instead of just storing a properly salted hash?
Now, the way I did it, at least, the key for decrypting it was in my code, so if someone hacked, there's a good chance that they would look through the code and figure out what the algorithm was and what the code was.
Still, if they just took the db and got out, and I fixed the hole before they realized it and came back, they would have a very hard time getting the passes.
37signals might be doing something like that, which is better than nothing. Now, they have no reason not to use a 1-way encryption algorithm, so it's still less secure than it should be.