Just to be clear, some micros (STM32s come to mind) have what they call "on the fly decryption" for external flash. Basically, if the micros wanted to, they would. I think ESP32s are also using qspi flashes but they're integrated in package? Maybe that's changed but that's how I vaguely remember it