Edit: it looks like when compiling, both project level connection managers and parameter files get saved to disk. Seems like there still isn't a way to pass these values in at runtime only (except for a command line overwriting the property perhaps).

Not to convenient .... I'll play around a bit longer but looks like I have to use encryptwithpassword.

Looks like the only alternative is to develop and test/debug in ssis with an encrypt setting on, and then change to dontsavesensitive when deploying/promoting. Pretty annoying