With MacOS, specifically, it’s stupidly easy and unintrusive to enable disk encryption. Outside of that, programs can save key-value pairs to Keychain (a credential store) and use that to store a randomly-generated encryption key.

It’s true that any program running with the user privileges and within its session can open the file, but once the user logs out it’s unreadable.

If the data was saved to the login Keychain, it should only be accessible while that specific user is logged in. The existence of vulnerabilities notwithstanding, it should actually be reasonably secure as long as System Integrity Protection is enabled and the program in question isn’t running. SIP stops users (including root) from messing with system files or processes, and the Keychain requires a user password prompt to give programs access to entries created by other programs.

Now, considering all the above… it would have taken a day at most to figure out how to encrypt the data before it gets written to the file so it’s not just sitting completely out in the open.