Your actual DB password is stored unencrypted in the
wp-config.php, i.e., if your password is
foobar, the corresponding line in
/** MySQL database password */
As @Rarst pointed out:
Having access to wp-config.php contents is already breach of security in progress.
This is because PHP is a hypertext preprocessor. Anyone who accesses
wp-config.php via their web browser will have the file routed through the server-side PHP interpreter. The interpreter passes only those data onto the client (the web browser) that it has been instructed to output. The DB password is not outputted by PHP. When I access my
wp-config.php through my browser, I get an empty page with no source code at all because this file does not output anything at all.
However, it is not true that having the DB password stored unencrypted is completely risk-free. Anyone who gets the chance to bypass the PHP interpreter and hence read the file's source will gain access to your password. This is also what @Rarst meant. To be clear, this can also be a man-in-the-middle who is eavesdropping on your unencrypted FTP connection. The moment you download
wp-config.php through an insecure FTP connection (in contrast to an encrypted SFTP connection) in order to edit it and re-upload it again to your server, the possibility your password being spied on does exist.
The easiest way to prevent most attacks is to keep your server up-to-date through security updates and to ensure to always use secure protocols (HTTP/FTP over TLS = HTTPS/FTPS instead of HTTP/FTP, alternatively SFTP, and SSH instead of Telnet) when dealing with sensitive data, i.e. when acting as administrator.
Read more on https://codex.wordpress.org/Hardening_WordPress.