All of these variables that you get via variable_get are stored in variable table, and loads everytime Drupal starts. Site Name, main email address, and other module configurations are stored in this table but NOT encrypted.
variable_get works anywhere in the site - in page templates, custom php blocks, etc.
The best way to protect your password is to not retrieve the password anywhere other than the FTP implementation. For an example, in admin forms, we use
variable_get('form-element-key-here', '') as the default value. So forms look like it stored configuration.
Do not do this for the password field. You can see the same technique used in SMTP authentication module and PHPMailer module.
Unless you leave Devel module enabled and insecure, nobody with php or database access can see your password.