>Attachments that don't have a filter can't be visualized

You can use :save or :pipe on these, but yeah - xdg-open would also be cool. Mailcap support would also be great.

>Account password is stored in plaintext

In a chmod 600 file, though. There's also an option for configuring a command to run to retrieve your password by e.g. decrypting it with gpg: see aerc-imap(5), or :help imap, for details.