The Securing wp-config.php sub-section of the Hardening WordPress page in the Codex says, in its entirety:You can move the wp-config.php file to the directory above your WordPress install. This means for a site installed in the root of your webspace, you can store wp-config.php outside the web-root folder.

Note that wp-config.php can be stored ONE directory level above the WordPress (where wp-includes resides) installation. Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission).

If you use a server with .htaccess, you can put this in that file (at the very top) to deny access to anyone surfing for it:

(code omitted: see link)
The key thing to note here is:

"Also, make sure that only you (and the web server) can read this file (it generally means a 400 or 440 permission)."

Since read-permission for the file restricts access, the fact that the file is 'just laying there' in a specific location on *everyone's* server ... makes it effectively 'not there', to everyone but "you", and "your server".

I think the rationale in suggesting wp-config.php "can" be moved, is that it offers an added level of security, if your server is compromised and access were possible through it. I believe that is a rare occurrence.