Indeed, but if you're doing it right, you won't have any passwords there. The things you need to access from a web app tend to allow trusted user access, so all an attacker would be able to get from a properly configured site's web.config would be the name of the database server (or the fact that it's (local)).