It's almost midnight in Europe, so you wouldn't have peak hours around this time. Which is not to say that people using Discord livestreaming for remote taching can't have overloaded it from other geographies.
man aerc-imap for details, you can specify an external command to run. The creds file is chmod 600, and most other email clients (e.g. thunderbird) are also storing your creds in plaintext - it's just less obvious cause they put them in sqlite or something.
Unless you are willing to provide a decryption key on every "check my email" call (eg. every 5 minutes), an email client (or well, anything requiring frequent reauthorization) virtually has to have it in "plain text" (or any obfuscated form which is equivalent to plain text).
Workable alternatives are to store the decryption key in memory for the runtime of the program (eg. using login keyrings or per-app logic).
If you encrypt your $HOME or your entire disk, storing it in plain text achieves roughly the same level of protection (eg. decryption key is in the memory).
Set TERM=xterm and try again. tcell (the library aerc uses to render its UI) has a really annoying built-in terminfo database, which at some point I plan on fixing myself.