Related question: why is a path stored and not the content of the (conveniently json) token file itself?
Not only encrypting path to file has no value ( encrypting contents of the file would — but I would totally expect the file (that ends up in Downloads folder btw — transient location) to be safe to delete once it has been ingested by the app.
Same goes about the duplicacy CLI — the content of the token json should be incorporated into the preferences file or keychain, not path, because path to external files is unobvious and prone to data loss when user inevitably deletes that external file because there is no indication that only link is saved