Setting up a new email account on mail, the password is entered for connecting to the in

Assuming that in this day and age you want security.

Setting up a new email account on mail, the password is entered for connecting to the in & outgoing servers before SSL is set. Before you can set SSL, mail connects to the servers so email password is transmitted unencrypted?

This seems a very obvious quirk/bug and something that I have always felt uncomfortable about.

Anyone else think this is not a good thing?