We must not store passwords in the regular flows file as this gets exchanged with the browser regularly and would leave things vulnerable.
The credentials mechanism is there to all a write-once-don't-need-to-read approach that allows the runtime access to the credentials without exposing them to the browser.