Well, I wouldn't put it like this and it does mitigate the risk by using encryption at-rest. Ephemeral values are improving this even further by preventing accidental access to sensitive values in the state due misconfiguration or similar scenarios.