If Kafka Credentials Leak, Does the Attacker Get Plaintext or Ciphertext?

TLS, disk encryption, and BYOK each stop a different attacker. None of them stops a leaked Kafka credential from reading topics in plaintext.