It's sent as plaintext and as a query string parameter. I'm not aware of any other way - but I'm sure with the move to https, we'll see https support for phones sooner rather than later - I guess the biggest challenge is certificates since you can't just accept a certificate on the phone as you'd do in a webbrowser.
In the meantime, I'd rely on separate VLANs and port authentication on the switch to ensure nobody hook in between the phone and the switch to get the traffic - and if you have untrustworthy individuals having access to the backbone of your network, you have a whole set of different problems that encryption of ip phone services won't cure.
