It is almost certainly on a disk with full disk encryption turned on, and password/biometric unlock. Unlike iOS, MacOD hasn't gone down the path of separate encryption keys, secured by the secure coprocessor, for each category of secrets.

The best solution to not losing confidentiality is not to collect it, and not to process it or store it. Relatedly, why does this daemon have access without permission being granted? If it was a third party tool it would not.