mysql master.info shows password in plain text
"The password" is a password the slave uses to log itself in to the master. In MySQL replication, the master's role is passive with regard to connections between master andbl slave -- the slave always initiates the connection.

The slave needs a password in order to connect to the master and authenticate itself.  Fundamentally, there's no way around that.  Encrypt it?  Okay, but the key then needs to be on the slave, so no ground is gained.  Hash it?  Well, no, the slave is the client.  It needs the plaintext password so it can generate a response to the server's auth challenge.  TLS?  Same problem, the slave needs a copy of the private key.

You can store it in a table instead of a file, but that doesn't really accomplish anything.

Correctly configured, though, this seems like a non-issue.  

If the account the slave is using follows the principle of least privilege and is locked down to holding only the necessary privilege level and being usable from only on that one machine (e.g. GRANT REPLICATION SLAVE ON *.* TO my_repl_user@ip.of.slave.svr IDENTIFIED BY PASSWORD 'slave_pw';) then the password and the associated account is fundamentally useless for compromising the master -- it's completely invalid unless used from the slave's IP (which the master reads from the IP stack -- this isn't a value the slave sends) and even then can only request the replication stream... so where's the problem?  If the slave is compromised, the password to the master one of the least interesting pieces of information, unless the account is not tied to the slave's IP address or is a reused password.