I believe only the ESP32 modules with 16M have QSPI flash, the 4M standard flash is on chip. For on the fly decryption you need on chip enclaves to store the keys. Anyway, it doesn't really matter for hobby projects and the ESP32 can also be used for commercial projects.
Indeed, the number of "non commercial" projects using these chips that are set up much less securely than even modest "hobbyist" projects boggles the mind.
