The wp-config file is plain text but it is like trying to read it in the dark bc it is not accesible by browsing. You cant browse to yousite.co m /wp-config and see it! If it were encrypted it would not work with mysql as far as I know. If there was a way then we would be using it i am sure.

If your info is that desired then they will find a way in no matter what u do or what you use. If host has insecurities then it might be easy for hacker to get in thru ftp and then they can see the config and get info DB but that not WordPress fault.

I have built bought and sold 50+ sites over the few years I have been using WordPress and Never had an issue with hacking on my vps. I hate having to update stuff every day but it is better than pulling out hair trying to fix a site. I have helped 3-4 peopl get their sites fixed and they were all several updated behind.last fall one was 2.7.x!

Has any self hosted sites been hacked on a dedicated or vps? Mostly all I hear about is with shared hosting.