This jira is not place for xtrabackup bugs, so I will close this as invalid.

mariabackup silently ignores --encrypt* options, so this exact problem is not relevant for MariaDB products.

But mariabackup may have similar problem e.g. if sensitive parameters of REST encryption plugins are passed in command line, e.g. --file_key_management_filekey

This issue should have relatively easy workarounds, e.g. pass secret parameters in variable or in cnf file:
--file_key_management_filekey="${MY_SECRET_VAR}"

Since mariabackup can load any custom plugin - there is no easy way to know in advance which options are sensitive, so users should not pass sensitive options in command line.