While reading the help for the "rclone crypt" command, I found this information:
Important The password is stored in the config file is lightly obscured so it isn’t immediately obvious what it is. It is in no way secure unless you use config file encryption.
but I can't find any command to encrypt the configuration file: rclone config
how to encrypt a configuration file? (what is the command?)
I suppose a more convenient alternative to manually entering a password on startup might be to use any support your OS has for encryption natively.
I don't know what option you have on Linux for this, but on Windows you could just set up a user for rclone with a good password - then use that account to encrypt the config. Then run rclone via that account. That should let rclone read it automatically, but no other user. The raw file is stolen somehow should not be easily accessible.