I don’t think transferring the file is a security problem, with hosted services you need to transfer the secrets somehow as well. And cannot choose how they are synced and must rely on the server being secured (in case that component is not hosted by you). Since it is synced to all devices, you are basically having a distributed backup of it already. But I agree, initial setup is a slight bit more work.