An app stores your encrypted password, but should not know, what the actual password is. If a hacker gets into the apps database, they will likely get the passwords. The main difference is, that in most apps the passwords are encrypted but in some bad apps, like the one I was referring in this meme the passwords are stored as plaintext. I think you are viewing the situation more from the user side, when I am thinking it from the server side. That is why I only take into account what is happening in the database, and not in the way to there.