Steps to reproduce the issue

(I raised this years ago, lets try again)

Configure a Joomla site with SMTP with Authentication credentials, the FTP layer (username and password) and proxy settings (Username and password).

Enjoy your site...

At a time in the future disable to disable these features by setting them to NO in Joomla global config

Click save.

See Configuration saved message

edit /configuration.php

Expected result

That the credentials and any configuration switched to NO is removed (set to default empty string if appropriate) from configuration.php

Actual result

Credentials are still stored, in plain text, in configuration.php even though disabled the feature in Joomla global config, and no longer viewable password in the GUI due to new Password Lock button process.

The "webmaster" is given a false impression and makes the assumption that No = Off = The provided credentials are no longer stored anywhere.