As I understand it from the write-up (and a brief look at the source seems to confirm that), Mailman 3.0 does encrypt passwords by default and does not mail them out any longer.
It is stored in unicode because that's what passlib hash algorithms return, not because there's an underlying plaintext representation.
So, it's unfortunate, but it's nothing new.