Just because the connection string is clear-type, does not mean that that is how it is sent by the SQL client library to the server. In fact, the connection string is never sent to the server at all. It is intepreted, and then, using an API, the connection is made to the server. The username and password may or may not be passed as plain text, depending on the specific API. In the case the SQL Client libraries, I very much doubt it is sent unencrypted.
my blog