Yes, you could.. And note that the json file does NOT have unencrypted passwords. It holds what the neo-datasource.xml file holds for the same passwords: they ARE encrypted, by cf.
The issue (as I discuss in the talk and is discussed in the cf docs) is that the json file ALSO includes the encryption KEY. As such, someone who has the json file can import that into ANY cf instance (as that instance would use that key to decrypt it, then it would be encrypted by the key in the instance, to be saved in its neo-datasource.xml file) .
And so that's why the cfsetup export offers an option to also choose a passkey, which encrypts that encrypted password in the file. 🙂 Then one can only import the json IF they provide that passkey.
Honestly, if a global find/replace on the neo-datasource.xml file can be done (to change what you need--and ONLY what you need), that would be one step rather than a few. 🙂
Either way, let us know how it goes.