> It's better than nothing

There are real issues with a false sense of security that you're glossing over here...

I didn't check but I assume they use SecureString.

I'd be surprised if they did and don't forget that it's serialized/deserialized from something which will be hanging around in the GC in the form of a memory backed stream or something too.

> the CLR which has no guaranteed memory zeroing

That's interesting. Can you elaborate?

> and has immutable strings and GC

Immutable strings is a pretty standard feature for a language, right?

Basically, when an object goes out of scope, it isn't de-allocated instantly.

Immutable strings aren't standard; they're an implementation choice.