Sounds like `strings' on the binary would've sufficed if it's just hardcoded.

No, that’s not enough.

The password would be visible, but the encyption algorithm and the script’s text wouldn’t.