Lawrence Finch seems to spend an awful lot of time using pseudo technical language to scare off normal users in this thread. It is absolutely false that passwords are stored in unrecoverable ways on macOS.
Lets look at several ways the system might use a password that was not explicitly entered and verified:
1. Keychains stores passwords (and other sensitive data) in an encrypted format but those passwords can be retrieved at any time by unlocking the keychain store. This is exactly what happens when password autocomplete is done in Safari, or when prompted to add or remove custom certificates, for example. In those cases the user need not know the password being retrieved from the keychain store, but just the password encrypting the keychain itself, then the passwords can be retrieved in plain text and used to fill out a form.
2. There are other parts of macOS that use passwords setup for the initial user account. The Login keychain uses the passwords setup for the initial user. This is a process that could be done separately on setting up the machine but, instead, the user account password is used to simplify things and avoid having to enter 20 passwords on setup.
3. With iCloud account login, the iCloud password is used automatically as the login password. Prior to iCloud account login on initial setup, users would enter any local password, that step is now optional and the password used for the iCloud password you login to on setup is used as the default password for the user. This confused the **** out of me the first time I setup a machine with iCloud login and was not explicitly asked for a password. Not saying it is bad, just something to be aware of. Just because iCloud doesn't know your password server side doesn't mean the machine didn't store the password, which is demonstrably visible in the login keychain.
Looking through most of these comments it seems fairly likely that something like #3/#2 is or was happening with these backups. iTunes is probably using the logged in account password as a default for encrypted backups to save a step for users, assuming that they use one password across their Apple devices.
There's an interesting article on a change in iOS 11 to allow resetting of the password without providing the original password (so long as the phone is unlocked). Could this have been made to mitigate some of the issues from this thread?