@Charlie - ...the Wordpress security has proved it’s not up to par with other big CMS systems like Drupal.

As I pointed out in my comments on the ZDNet story, this was not a WordPress-specific problem -- the attacker could have targetted Drupal's settings.php file just as easily. Drupal stores the database connection credentials in plaintext, as well. Just like almost every web application out there.

As Matt pointed out on the dev blog, the web server has to be able to get the database connection credentials from somewhere. Anybody who is able to run web code in the same sandbox as you is going to be able to sniff that information somehow. The solution to this problem has everything to do with how the web server and OS are configured, and pretty much nothing to do with WordPress itself.

In a shared hosting environment, the hosting provider must do everything possible to isolate users from each other, and prevent one user from gaining access to another user's files, no matter what avenue they might try to go through. Typically, this is done through 'chroot' or 'jailed' environments.