Really? I would have assumed that they do what keychain on macOS does which is password gate the decryption key, so it's good to know they're just sitting on disk somewhere. It's a shame as half assed stuff like this is why people don't trust these tools :-/

Huh. So it's just to protect against casual perusal I guess?