The best 'workround' I can think of would be to create a command file that passes the passwords at execution time, instead of storing them in a configuration file.

This would allow you to encrypt the command file, while leaving the rest of the install media unencrypted and without any sensitive information.

It should be possible for the owner of the encrypted command file to run the command within it, without non-authorised people able to see its contents.

Once the passwords have been passed to the SQL install process they are held in memory, and any time a password needs to be printed it is shown as a fixed number of *.