On 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.
Wonder if it got bumped on accident on a recent update. My system has been modified to allow system access, so its less surprising (although still a flaw). But we did it on machines by people that are probably TOTALLY unaware of those 10.11 changes and wouldn't have the know how to modify something like that, and it still worked on their machines.
They might have turned it down or off because it was buggy.
Trying to get a password out of my keychain using Screen Sharing completely hosed it (10.11 initial release). Even opening Keychain Access resulted in an instant freeze and spinning wheel. I ended up having to completely recreate my keychain and reset a lot of passwords.
