Hi,

Indeed, only root user in the guest can read it Any user that can see the XAPI object will be able to read it

So I would say it's "reasonably safe", but it all depends on your global usage context and level of confidentiality you need.