When having IOT package on your router and export the config, you will see the MQTT password.
That should be only shown when doing an export show-sensitive

So MT please fix.

Did made also a ticket with support or did you just put it up here? ;-)

SUP-151732

It will be fixed

Our bug tracker reports, that your issue has been fixed. This means that in the upcoming days, we plan to release a RouterOS update with this fix.