@Terence -

well if its not exploitable, why does the codex suggest “hardening” by moving the wp-config.php file elsewhere? Seems to me, if its so safe, there’s no need.

Just because something can be made more secure doesn't mean that, in its current state, it is inherently insecure.

You can’t have it both ways.

Yes, you can. Technically speaking, WordPress doesn't actually even install the wp-config.php file. The end user does. WordPress provides a sample, and provides instructions for where/how to configure and upload it. The WordPress boot routine is designed to look in the root install directory, and one directory higher, for wp-config.php. One may or may not be more secure (if WordPress is installed in a subdirectory, then both locations are still in the public_html space; so it really doesn't matter).

But the whole idea of leaving those credentials in plain text, no matter how many other programs do it as well, seems to my non-developer (il)logical thinking, to be an accident just waiting to happen.

You are conflating plain text with publicly accessible. Yes: the wp-config.php is in cleartext. That's rather required for a server PHP script to communicate with the SQL server. But even though the credentials are in cleartext, they are not publicly accessible.

And for @Ipstenu to say they all do, so its OK, to me seems rather like saying – “those cars all have lousy brakes, it doesn’t matter if my car has lousy brakes too”.

My brakes are just fine, thanks. (Go ahead: try to grab my wp-config SQL credentials.)