In reply to Glen.

Yes I already have all of my config files one layer above (note: not all host servers allow this, but where they do, I do make use of it). I wonder how many other people know this though (think: non-web designers, simple bloggers).

However it's just my surprise that highly sensitive details are still placed by default, and left there in such an easy place to obtain.
What i'm getting at really I suppose is that WP dev do not "appear" to have paid much attention to built-in front end security, considering the very subject of this thread and how long it has been a known issue.

Frankly: out of the box, WP is very weak.