How uncommon is it for apps to store sensitive data in this way? It wouldn’t surprise me if this is a pretty common, albeit non-ideal, practice. For example, where does chrome store browsing history data?
I literally don't know of any app that automatically encrypts its own data aside from those that make it a selling point to do so. For the most part that's completely unnecessary and redundant, as it's handled automatically by the file system when FileVault is enabled.
Most apps store data in a sandbox so other apps can't access it.