In order to understand how a hacker could access this file you have to think like a hacker, mainly outside the box, of what most would consider to be "normal" methods for accessing a file.
To that end, someone could gain access to a daemon which may have root privileges, and then induce this daemon to read the contents of the
/etc/shadow file. I've seen many examples throughout my career where developers or unknowledgeable sysadmins have run applications such as Tomcat or Apache as root.
These same methods can be used to augment the permissions on files as well, though a good hacker would not do something so obvious as to be detected, safer to read the contents of these files and stash them somewhere else or retrieve them from the box.
As to the type of file which
/etc/shadow is, it's clearly marked as a text file on my CentOS 7.x system.
$ file /etc/shadow
/etc/shadow: regular file, no read permission
$ sudo file /etc/shadow
/etc/shadow: ASCII text
Its permissions are as follows:
$ ll /etc/shadow
----------. 1 root root 1150 Oct 29 11:44 /etc/shadow
And hashed passwords are clearly visible per user:
$ sudo grep vagrant /etc/shadow
$ sudo getent shadow | grep vagrant