Hopefully they use setproctitle() to erase it. Pretty sure this is what mysql does:

jolan 4950 0.0 0.0 46164 8820 pts/12 S+ 16:06 0:00 mysql -uroot -px xxxxxxxx

Probably still a race condition and can be viewed before it is erased but at least it would be something.