PowerShell Core currently uses some APIs that only take plain password text, because the overloads that take SecureString is not available in .NET Core. But once they become available, we need to update our code to switch to the latter.
Instances: (not a complete list)
Constructor of NetworkCredential at Credential.cs
Constructor of X509Certificate2 in CertificateCommands.cs
ProcessStartInfo.PasswordInClearText at [Process.cs]
Feel free to update this list when you spot one.