We have very sensitive information in notes and can't afford to widen the surface area of possible data leaks. Sure, Slack might get hacked - that's still an issue.....but adding even more untrusted, unpaid services that can read our information is not a great path to go down.
i'm not sure whether you understood the term "at-rest", all that would imply is that the data disk (or perhaps the database) is fully encrypted, but the server holds the decryption key at runtime. that would add no security because anyone who hacked into the application server will still be able to dump + decrypt all the notes, all they have to do is also dump the key from the running server. what you need is end-to-end encryption, so the server only receives the encrypted notes from the client.
Given that we're targeting technical teams using Slack, we focused on productivity features and usability first, but our roadmap is open to change based on user feedback :)