In Gawker's case this is exactly right. The database AND the source code was accessed so the config file defense would not have worked.