Um. What? Assuming that a PCI-compliant level of encryption was used, "matter of time" is "heat death of the universe" if you don't have the encryption keys.
One potential reason it's preferable to use an innocuous, generic text editor is the potential supposition by an attacker that they only need to infect and/or monitor the card processing application. If someone spreads a malicious update that has a built-in keylogger only for that application, for instance, copy+paste from the non-infected program would stop it from recording the data.
Though I think that's stretching it a bit. Maybe your auditors encountered something similar previously?
It was something the auditors just brought up on their own, so yeah, I'm assuming they'd run into it before.
This isn't CSI. You don't just throw encrypted text at an implausibly attractive IT guy and wait for him to furrow his brow, declare that it's military-grade encryption that will take him a little while, and then have him decrypt it by the end of the next commercial break. PCI-compliant encryption is the sort of thing that, barring incredible leaps in technology or the discovery of a significant algorithmic weakness, will never be crackable in our lifetime.
That the information had encryption is a good sign.
You might want to rethink this. "Will probably not be crackable in the next twenty years" is more realistic.