Explanation/Reference:
The SSISDB catalog uses the ServerStorage protection level. When you deploy an Integration Services project to the Integration Services server, the catalog automatically encrypts the package data and sensitive values. The catalog also automatically decrypts the data when you retrieve it.
If you export the project (.ispac file) from the Integration Services server to the file system, the system automatically changes the protection level to EncryptSensitiveWithUserKey.
References: https://docs.microsoft.com/en-us/sql/integration-services/security/access-control-for-sensitive- data-in-packages?view=sql-server-2017