Good question, had to do a bit of research, but the MSDN link doesn't really back-up the explanation as it doesn't mention salt anywhere.

edit: in this thread, an MVP does the suggestion of adding a salt to the string itself.

http://social.msdn.microsoft.com/Forums/en-US/sqlsecurity/thread/6002f5a4-19a0-4a11-a569-e112375d3efa/