I'm not sure why you feel that way, Josh26. If anybody finds something they feel is a security vulnerability that hasn't been addressed by a previous VMSA/patch we'd appreciate that you immediately contact security@vmware.com and provide as much detail as possible regarding what you've found (http://www.vmware.com/support/policies/security_response.html). We actively investigate all reports.
In this case, while the password is stored in plaintext (and actually can not be stored as a hash due to how it's later used), the file itself has strong protections based on file system ownership and permissions restricting access to Adminstrator.
