I have no idea where on earth this reputation for WordPress storing DB details in clear text comes from. WordPress has never stored them in clear text all the way back to version 1.5 (I haven't looked in older versions but I assume they didn't then either).

I've also never heard of an up to date WordPress installation being hacked via WordPress itself. I don't think that has happened for a very long time.