@Terence -
You need to - actually - "make your case" that wp-config.php is providing the means to compromise sites. You aren't doing that.

If you have serious accusations to make, you need to do right by yourself, by making them well.

You might need to do homework. You certainly need to find & present some specific evidence.

I understand that this config info might look like an exposure. However, Terrence, Ipstenu points to the key clue/fact - that these files exist and are not leading to issues.

I think there are other elements involved, that forestall the scenario you think config-info is posing.

There has been a problem, but again, the wp-config.php file was not involved.