So far this is unconfirmed:

If a password uses f:password backed by a String value, 2.236 and newer will round-trip that value encrypted. DataBoundSetter etc. will decrypt it, but any code accessing the submitted form value directly (e.g. StaplerRequest#getSubmittedForm) will probably experience a regression.