That's all true - but in production systems, the risk of someone getting ahold of a single password table in a database is differnet than, say, getting the sour

That's all true - but in production systems, the risk of someone getting ahold of a single password table in a database is differnet than, say, getting the source code to the production system. Just because they have one doesn't mean they have no other. If someone can get all your production code, data, AND configuration settings, you are screwed no matter what you are doing.