Focusing on the actual problem, your ISP needs to have a way to authenticate its customers (a 'password') when they phone customer support. This means that such password needs to be told to the support agent. Of course, it would be a bad idea to tell them your password, so apparently they decided to setup their system such as:
- Store the password unhashed internally
- Their agents can't view your password¹
- Their support software does have access to the plaintext password, and ask for a couple of characters (different ones each time) in order to authorize you.
This way, the person servicing your call will, at most, know the two characters that you provided.
Compared to giving out your full password to them, it is more secure. Maybe they even eg. store in plaintext² half of the password and hash the other half. It would be desirable that they supported having a different password for phone support than their website (perhaps they do but you would need to set up such "phone password" separatedly?) but once you consider the additional requisite of customer support authenticating you through phone, it's not that unreasonable, unlike the case when you are authenticating directly to their website without any middle-men.³
One would still expect that they implement other sensible additional measures. Anyway, don't use any sensitive password. It is best if you use a password manager with a random password only used there.
It is also a good idea to follow the suggestion of Rui Freitas Serrano and ask them about their authentication process and how they protect the security of your account.
¹ So we hope, at least.
² Plaintext and reversible encryption are mostly equivalent here