For the vast majority of sites storing passwords in the clear is a bad idea.
However sometimes you need to store sensitive data. Generally this is done with hardware security modules which rotate encryption keys in a periodic basis. Access to the sensitive data is also audited.
Risk can be minimized. It just comes down to if it is worth if for your business. PCI DSS is just one example of minimizing risk.
Uh... the code in question is retrieving those passwords and emailing them over unencrypted SMTP. How is that design improved by the use of key rotation or "hardware security modules"?
By using a HSM you store the encryption key on a separate hardware device. I am already assuming that if you want to implement something like this you will encrypt the passwords. Thus the problem is knowing where to put the keys.
However sometimes you need to store sensitive data. Generally this is done with hardware security modules which rotate encryption keys in a periodic basis. Access to the sensitive data is also audited.
Risk can be minimized. It just comes down to if it is worth if for your business. PCI DSS is just one example of minimizing risk.