> How many developers have plain-text tokens lying around on disk?

Most of them. Mainly on purpose, (.env files) but many also accidentally. (shell history with tokens in the commands)