External SPI flash can be encrypted on-the-fly with most real commercial MCUs - the issue is that this was not designed to be a commercial MCU for use in products.

Relative to other offerings, it's pretty nice (not a fan of ESP32 Xtensa or their new RV32 offerings - ARM chips are so much better) as a DIY/hobbyist/open source chip.