I just learned something. the Vision assistant plugin, like so many others, sure, it hides the API key in the settings screen, but it's stored in plain text in nvda.ini. that's how it's able to show it to you when you check the show API key checkbox. I've removed the plugin, reported the issue, and thanks to @FreakyFwoof's NVDA sync plugin my INI's clean. Damn developers, do better where you store your API keys sweet fucking jesus.
@munchkinbear Oof, I'm not removing it as I have some uses for it, but Jesus Christ why these devs don't store that shit in the Windows credential keychain is beyond me. @FreakyFwoof