The config file is writeable by the webserver. This is a major security risk because anyone can change your server settings now by using the install script.