You are absolutely right, but as you noted yourself I don't think it's a "feature" and I don't believe that I can implement it in any sane way. The users that have the skills to actually make the nessecary changes to httpd.conf (of use .htaccess) also have the skills to modify their config.php to include a file from a protected directory or something similar. Having two different methods of storing the database password seems like something that would cause more problems than it would solve.
Also, actually crashing PHP isn't _that_ easy since you can only run the scripts that the "target server" is serving. Or is it easy? I've never managed to do it by mistake anyway :-)