Not trying to defend that application, as it's clearly a bit shoddy, but sometimes encryption of a user's password isn't a programming choice. Sometimes it's a decision that is made by people without a security background and imposed on those who are destined to implement this bogus approach. The reason is pretty simple, some people think that original passwords should be emailed and not reset. If you check around you'll find this is more common than you'd expect, equally common is membership without proper activation procedures.

Now, on to stored procedures, until fairly recently MySQL didn't do them. There's also a pretty strong argument against using them for web at all regardless of the platform, when you have a whole ever-growing bunch of cheap, identical application servers facing the customers and the back office with a big database server or two driving them do you really need to put computational stress on the database server?
What happens when you need to double the number of webservers due to a sudden boost in popularity? You need more CPU and memory in your database server, you need a new database server chassis eventually. Sure, if you've got a database server with enterprise level storage you can deal with this, but if the startup chose to use LAMP there's a fair chance that they're not cash rich and may just be out to test the market. They probably have the cheapest hardware around that can meet their performance demands.

A common way to make this class of LAMP application robust and easy to work with later on is to use a DB abstraction library and put all the calls to that library in a set of functions that are called by the business/page logic. The effect can be almost the same as stored procedures in terms of maintainability, the only loss is the performance gains of being able to optimise stuff within the database.

You're right, unfortunately this situation is very common.
Regarding the stored procedures; in-line SQL that are called from within code, are compiled at runtime by the SQL server, hence more load on the server. Stored procedures are compiled when saved, along with an execution plan (some servers).
But yes, as you state, using a data abstraction layer is the right approach, no matter the development environment.