Possibly, the machines that got rooted were just the nodes running PHP code. Each 'site' may have database user/pass for their respective tables and not the DB

Possibly, the machines that got rooted were just the nodes running PHP code. Each 'site' may have database user/pass for their respective tables and not the DB root. However, if the servers that got rooted were the DBs then that would be very bad. You could dump, crack etc... There are other vectors to consider, such as 'workers/jobs' doing 'db cleanup' where they would need some 'dba' access.