Can a Hacker gain access to my database if i've left the default authentication key value in place in my wp-config.php?
They'd need to know the user and password of the database, and even then I'm pretty sure the Wordpress config default auth strings aren't human readable like 'put your unique phrase here' as in your example (from memory, I think that appears commented out on the line above), but are actually GUIDs. Therefore, unless Wordpress uses the same default GUIDs in every zip package, I wouldn't presume that is the culprit.