@Terence

The section on hardening your WordPress install is like purchasing a deadbolt for the door to your house. If you lock your door when you leave the house you are secure but if you wish to sleep a little better at night you install a deadbolt making it more difficult to break in. That is why the section it labeled "hardening" your WordPress install and not "securing" your install.

Also, having the MySQL login details in plain text of the wp-config.php file is the standard way that most, if not all, frameworks connect to the DB. Until another more secure way comes along, this is the best option.