One issue is that even if the password database is more secure than root access on the server, having the database at all means that it's possible to steal the

One issue is that even if the password database is more secure than root access on the server, having the database at all means that it's possible to steal the entire thing in a small amount of time and in a way that may be difficult to detect. An attacker with root access on the server would have to keep the exploit open to continue gathering user credentials. And I still don't see what convenience having the password database offers. One-time links are definitely the right way, though I think it's better to give the user a new password dialog than to tell them a randomly generated password.