It means that if someone sees your config file, they can't log into your sites and impersonate users (unless they have a LOT of money/resources and can reverse

It means that if someone sees your config file, they can't log into your sites and impersonate users (unless they have a LOT of money/resources and can reverse secure hashes -- one account at a time). It makes attacks impractically expensive.