Account data isn't encrypted? Is that an oversight?

Not exactly. Some data like push rules and presence configs needs to be unencrypted so the server can process it. There is still value in encrypting other parts of account data tho