I suspect the comment was incorrect.  I don't think the CachedPasswordUserInfoService ever sends the password to portlets in anything but clear text.

Certainly the ClearPass integration provides it in clear text.