Whenever someone says "But it should have been encrypted!" about things like configs on a server, I ask them how they'd implement that in practice.

PoC or GTFO.

I think you'll find it's a bit harder to do than you expect.