drush archive-dump leaks sql credentials

During the work done in fixing drush sqlc credentials leakage (#671906: mysql credentials leak in drush sqlc), I have found other leaks. Here is an example:

11589 pts/10   SN+    0:00  |           \_ php /usr/bin/drush @www.example.com archive-dump --destination=/var/aegir/backups/example-archive-backup2.tar.gz
11673 pts/10   SN+    0:00  |               \_ sh -c /usr/share/drush/drush.php  --db_type='mysqli' --db_host='mysql.aegir.koumbit.net' --db_port='3306' --db_passwd='CENSORED' --db_name='examplecom_0' --db_user='examplecom_0' --installed --root='/var/aegir/platforms/drupal-6-build-2012.04.26-production' --uri='www.example.com' --context_type='site' --platform='@platform_drupal6build20120426production' --server='@server_master' --db_server='@server_mysqlaegirkoumbitnet' --site_path='/var/aegir/platforms/drupal-6-build-2012.04.26-production/sites/www.example.com' --site_enabled --language='en' --client_name='cl-example' --profile='default' --ssl_enabled='1' --ssl_key='www.example.com' --loaded-config core-status --backend  2>&1
11674 pts/10   RN+    1:19  |                   \_ php /usr/share/drush/drush.php --db_type=mysqli --db_host=mysql.aegir.koumbit.net --db_port=3306 --db_passwd=CENSORED --db_name=examplecom_0 --db_user=examplecom_0 --installed --root=/var/aegir/platforms/drupal-6-build-2012.04.26-production --uri=www.example.com --context_type=site --platform=@platform_drupal6build20120426production --server=@server_master --db_server=@server_mysqlaegirkoumbitnet --site_path=/var/aegir/platforms/drupal-6-build-2012.04.26-production/sites/www.example.com --site_enabled --language=en --client_name=cl-example --profile=default --ssl_enabled=1 --ssl_key=www.example.com --loaded-config core-status --backend

CENSORED is *not* actually censored by drush, and appears in the process list. Anyone having PHP execution in any Drupal hosted on this server can root this example.com site.