As the Bitcoin Core docs state:
Although Bitcoin Core's RPC interface does use authentication, it does not use encryption, so your login credentials are sent as clear text that can be read by anyone on your network path.
Why doesn't it use encryption?
This was answered by various individuals on IRC. I will paraphrase and any errors are my own.
The Bitcoin Core RPC interface was previously encrypted in an old version of Bitcoin Core but it was removed because it is pointless complexity. The RPC is only intended for communication with trusted, local software and as long as it is used for what it is intended the encryption is unnecessary. The operating system can intercept everything whether it is encrypted or not. There is documentation on how to SSL wrap it though.
It was noted that some people are using the wallet RPC over a hidden Tor service which should be fine if it is only exposed to trusted clients.
(Bitcoin Core also doesn't support UNIX sockets. It was attempted in some unmerged PRs in the past and is easy for RPC at the server side but on the client side it is blocked by an issue (1, 2) in libevent http. It is currently not possible at least in bitcoin-cli without some ugly hacks around libevent.)