Isn’t this normally stored on an encrypted volume anyway? If the user cares about security even in the slightest, they’d be using FileVault, of course

So really, this type of encryption is defeating scanning/probing, not a dedicated attacker who knows where to look and why. In such cases the attacker is worried about gaining access to the walled garden first — where the protections are.

Filtering out amateurs seems to be a reasonable goal.

I think this is more like putting a lock on your door. It won't deter a locksmith or a dedicated attacker, it just filters out the low effort attackers.

I'd compare it to non-encrypted and signed pagestate in ASP.net or JSP, it works but it's completely untrustworthy. IMO this shouldn't be hard for apple to solve either, they can just create a key in keychain and use that to sign the file using the existing and standardized XML signing algorithm. That way any change to the file, even the XML will cause it to get discarded.

Respectfully, why would there be any valid use case for understanding the private format stored by this DB? In ideal circumstances it is private, is it not?