Hi @imincognito,
First of all, if your question is if your CF API is cryptographically encrypted inside the plugin the answer is no. It is not. The reason it is not done in that way is to ensure that the server do not have to work extra hard to encrypt decrypt the API Key/Token all the time before sending an API request. As on a low end shared server this might add much extra cost.
Moreover, your API key is stored inside a PHP file instead of any other static file like JSON. The reason it is done that way is to ensure even if someone tries to access the file they will get noting in return as it is a PHP file.
I hope this helps.