It's conceivable that they don't store passwords in plaintext. They could be hashing the last 4 digits separately... but they are probably store passwords in plaintext.

That's still terrifying. How difficult could it be to crack a hash if you KNOW it's only 4 characters?

On the other hand, if your password is seventy characters long, knowing the last 4 doesn't help much.