Having been on dozens of Pharma automation projects, PLC software (the logic and data in the PLC) is definitely Category 5. Once in a while, with key-lock protection, standard PLC files/routines that can be compared against a "vault" version, configurable I/O and reusable subroutines, I can get Validation to treat the PLC as whole as a Category 4 system.
No, I would never be able to convince an FDA inspector (or a plant Quality or Validation manager) that the PLC can be used to store data. First of all, to meet 21CFR Part 11 requirements for data integrity, a PLC would need to have a time-stamp attached to each piece of data. Secondly, PLC data tables are easily manipulated online or offline, and the data storage limits in the PLC (2 Mb on average) doesn't go very far. It is much better to retrieve the PLC values and store them in a relational database, whether a custom SQL solution or a commercial historian product. The PLC, from a data standpoint, is essentially only as secure as a memory stick plugged into a PC, but with logic capability.