But a malware will scan for anything that looks like some credentials on your machine. So if you have a script with clear credentials backing up to a ftp server

But a malware will scan for anything that looks like some credentials on your machine. So if you have a script with clear credentials backing up to a ftp server, the malware will go after the backup. At the end of the day it depends on what is your threat model. Mine is 1) automated malwares and 2) my own fuckups. I am not trying to prevent the NSA from hacking me. Against an automated malware, custom scripts with encrypted credentials that don't show in clear in command lines or environment variables are probably good enough.