I wouldn't call it overkill. Other bugs in your program could allow hackers to read parts of memory that could contain sensitive data, or if your program does a core dump, the sensitive data could show up in the dump file.
Some customers at my company complained that some of our dump files contained user passwords in plain text.

