How would you propose protecting it?
Hashes are one-way, they can’t be reversed back to the original data.
User passwords are hashed because they don’t need to be reversible. A password hash in the database is only consulted when the user tries to log in. The hash of the provided password is compared against the password hash stored against that user record.
It’s fairly common for things like SMTP passwords and API keys to be stored in plain text. They need to be transmitted in their original form, so hashing them would prevent their use. If the third party accepted a hash of the password there would be no benefit in hashing as a form of protection.
As Jay said above, if the physical integrity of your server is compromised and your app.yml is accessed you have significantly bigger problems to worry about than the need to reset an SMTP password.
One important caveat here- you shouldn’t be using the SMTP password anywhere else - but that’s not specific to Discourse. It’s good security practice for all systems and every account.