It's as safe as other credentials stored in wp-config.php. As long the WordPress hardening guide is followed, as well as general security best practices, you should be fine.
Issues that could affect security:
- Since it's a shared server, if users are not chrooted, they can read any files that have global read ownership on the server, including wp-config.php if incorrectly set.
- You can mitigate this by removing global read from wp-config.php, which is best practice anyways.
- File disclosure vulnerabilities could allow someone to read the configuration file through a vulnerability in the website.
- Depending on how your web server and/or .htaccess is configured, creating backups like wp-config.bak or wp-config.php.bak will could expose that config file as it may not be protected like wp-config.php would be. Be careful where you put those. Definitely don't put them in the webroot.
- Only use plugins you need. Uninstall ones you don't. Follow security best practices, like the hardening guide.
- Path traversal vulnerabilities could allow the config file to be exposed and read through a vulnerability in the website, even if it's a directory up.
- Follow the same guidelines as above.