You're right. To me, it's not their use of (effectively) plaintext that is worrisome. It's that the developer characterizes base64 as "encryption", which tells me that they don't even understand the security implications. As an example of a non-worrying response, here's Pidgin's documentation on their choice not to encrypt passwords: http://developer.pidgin.im/wiki/PlainTextPasswords

Well, as you say OSX has the keychain (which is encrypted, and has command-line access tools). I think most Linux systems have something similar ('keyctl' on my system). I know nothing of Windows, but I would hope something analagous exists there too.

I mean, mail clients such as Thunderbird can be set up to safely remember passwords without storing them in cleartext, right? So clearly it's feasible...

For Windows you can use the DPAPI, take a look at http://msdn.microsoft.com/en-us/library/ms995355.aspx. Of course if the intruder has your credentials then he can create a process to steal the encrypted passwords, but at least he can't just read the file by mounting the FS somewhere else

Every hour, generate a random passphrase and output it to a source file. Trigger an automated compile of the project and bake it into the executable which is then auto-bundled into the installer. Upon installation, generate an additional random passphrase and concatenate the two together to form the symmetric encryption key. It's still security through obscurity, but it's a hell of a lot better than base64 encoding.