Why docker login command saves unencrypted password on my computer?

You can use Credential Store for this purpose. Here is the offical doc from Docker:

Credential Store

This is now solved, and as you suggest, you can save to the keychain (or use other "helpers"). Full details are in the Docker docs: https://docs.docker.com/engine/reference/commandline/login/#credentials-store

For anyone interested in the history and why this wasn't a trivial fix: https://github.com/docker/docker/issues/10318