> It is not a default by any means
Yes it is.
Caution:
Kubernetes Secrets are, by default, stored as unencrypted base64-encoded strings.