I’m comparing this to how Google requires you to authenticate yourself via OAuth for security vs how this is asking you to put in your Proton username and password and 2FA and it gets stored as a token in the config file.

Without disk encryption it is a problem if your pc/laptop is at risk of being stolen. With disk encryption it is a problem if an attacker has physical access while the computer is powered on.