If you go to Settings -> Backup & reset
there is a Back up my data
option which states:
Back up application data, Wi-Fi passwords, and other settings to
Google servers
In addition to this on the Android OS support site it says:
a wide variety of your personal data is backed up autonmatically,
including your Wi-Fi passwords, Browser bookmarks, a list of the apps
you’ve installed on Google Play, the words you’ve added to the
dictionary used by the onscreen keyboard, and most of your customized
settings. Some third-party apps may also take advantage of this
feature, so you can restore your data if you reinstall an app. If you
uncheck this option, your data stops getting backed up, and any
existing backups are deleted from Google servers.
As for the security concerns although I assume they must be sending plain-text WiFi passwords according to the Backup Service developer guide they're at least using a secure connection to do it over.