In its discussion of the exploit, the Sucuri article (linked above in this post) does not mention the wp-config.php file. There is no indication that it is involved at all.

Sucuri then links to a previous post of theirs, Malware Campaign from .rr.nu which offers more info on how the exploit is (and isn't) being conducted.

This is an organized campaign.

To repeat the repetition - Sucuri says:We can safely rule out any new vulnerability on WordPress itself.

It should be noted, that older versions of WordPress could be the target, in part simply because older versions have been available for study, longer. Given time, the current version could prove vulnerable, too.

Does that mean that Matt Mullenweg is a security silly-goose and his product is a threat to Civilization? Probably not. Recall, that the CIA, FBI, Microsoft, Google, etc, are also subject to attacks, with some interruptions and other problems resulting.

It has more to do with 'the price fame & prominence'.