My understanding is that the passwords are stored in DPAPI. So yes, they're stored locally, but they're not stored in plaintext and require the correct encryption key to be able to recall / decrypt them. From distant memory in working with this stuff, the encryption key is derived from the credentials of the current logged in user who is storing the information, so, in theory, only that user can pull the data out and decrypt it.
In the case of the task scheduler, I imagine the data is stored by the account that the task scheduler runs as, so anyone who can impersonate this account (might be SYSTEM
by default) can retrieve the data.
"Is it safe" is an entirely subjective question. Unless you encrypt data on disk and keep the key well away from disk, it can, theoretically, be retrieved.