This old forum question: http://forums.esri.com/Thread.asp?c=159&f=1707&t=285123 implies that with ArcObjects it is indeed that easy to extract a password from a connection file. Because really what is the security risk? Being able to access the SDE connection file means I can set that as my workspace, then do operations such as update and delete with the privileges associated with the user name in the SDE connection file. Being able to extract the credentials to use for a cx_Oracle login would not provide the script with any more privileges than were already available through the normal geoprocessing tools.