With WordPress providing the SQL login and password in plain text in its wp-congfig.php is it any wonder why so many WordPress sites get hacked and WordPress gets the reputation for being difficult to impossible to make secure?

So does Drupal, Joomla, MovableType, ZenPhoto, MEdiawiki... Shall I go on? Not the point.

I have no idea where on earth this reputation for WordPress storing DB details in clear text comes from.

Ryan, it stems from the wp-config.php having the SQL user ID, password and DB name in it. That's all. Which ... well. Yes. You have to have those to get into the DB.