@ChristophRo,
First of all, if a server is fully compromised, then a server is compromised - no need to obfuscate passwords (or not) in that specific scenario.
However, when a server is not fully compromised, parts of the server can be accessible and that can be enough to reverse engineer...