Once it's networked you lose the "whitelist of systemd services" and it's then no different from any networked secret store.