On iOS, with everything sandboxed, maybe that'd be harder to pull off. I think on macOS, though, it'd be easy for other apps to potentially read these the files as long as the user is logged in.
Keychain, on the other hand, has an additional layer - items are linked to the app/developer/app-group. So other apps cannot get items that aren't theirs. That seems better except for the issue where the user might have disabled only the keychain syncing. (Or if the sync is delayed for some reason.)