Yes, that's definitely an alternative.
But so far I was trying to keep WinSCP configuration easily portable. This would prevent that. But as an op-in feature, it might do.

As documented in
https://cwiki.apache.org/confluence/display/SVN/EncryptedPasswordStorage#EncryptedPasswordStorage-WindowsCryptographicServices, Subversion is able to store its passwords in a cryptographic store that Windows itself maintains. Could this be another option for WinSCP, as this closes the gap between having the passwords store somehow unencrypted anywhere and having them stored using an application specific master password?