Function select 

pub fn select(
    choice: BackendChoice,
    _state_dir: &Path,
) -> Result<Box<dyn CredentialStore>, StoreError>

The file store is the only backend. Its contents are plaintext on disk, protected by filesystem permissions alone — nothing here encrypts them.

Selection still goes through this seam, and the choice is still explicit, so a second backend can arrive as another BackendChoice variant rather than being wired in somewhere else. state_dir is the host’s own state directory, unused while File carries its own root.