An unencrypted token is just as vulnerable as an unencrypted password.
But if the stream isn't encrypted then it doesn't matter. A robot can easily collect the token and utilize it before the token expires.