The password is probably encrypted, but reversibly so. That's still a potential security hole, but an attacker would need both the database (with its encrypted passwords) and the key.