There seems to be an bug with merging of connections. If you export connections including passwords (specifying primary pw etc.) and import the exported connections, only those connections which don't already exist get password restoration, others are lost. This is quite an insidious bug, as passwords could end up nuked. Although users could delete connections first before importing, sometimes the connections file could be a subset of connections, for example, from another team member, so it's not always obvious which to delete.
I just tried to reproduce this and could not. Here's what I did:
Clicked the "export" button on the login window on 16.0. Gave it a file name (c:\temp\connexp.xml....I probably don't have to say this but not User Files\Connections.xml). Checked the "include password box" and supplying a password
copied c:\temp\connexp.xml to another machine, also using Toad 16.0, and imported the file with same password (I get an error and nothing imported when using the wrong password)
everything imported successfully
re-did the import to see if passwords would get nuked that time, they did not.
Both copies of Toad had the "Save passwords" box checked in the login window.
If you did some steps differently, please let me know.
Funnily enough, I'm setting up a new workstation (my old one is due to be decommissioned) and just did the same as you and once again, all passwords were empty. I deleted all of the connections, did it again, passwords preserved.