> Also the OP seemingly implies credentials are stored on-filesystem in plaintext but I might be extrapolating too much there.

To be fair, some tools only support a netrc file for http(s) based auth. Regardless, if you want to use git via http this vector exists almost always.