This would be an FSFK problem as well, anyone who has access to that URL would be able to download that config file, whether through phpvms or through the fsfk scripts
I'm hoping that VA owners made a restricted username/password for, and didn't use their main FTP user/password.