How can I pass a sensitive/password-type setting to a custom (SDK-based) mapper plugin? There doesn’t seem to be a good way to do so that I can find.

I think you can do something like the example in https://github.com/meltano/sdk/issues/1073:

plugins:
  extractors:
  - name: tap-csv
    variant: meltanolabs
    pip_url: git+<https://github.com/MeltanoLabs/tap-csv.git>
    settings:
    - name: stream_maps
      kind: object
    - name: stream_maps.stream_map_config.hash_seed
      kind: password
    # Note that these don't work: <https://github.com/meltano/meltano/issues/6382>
    config:
      stream_maps:
        customers:
           email: __NULL__
           email_domain: owner_email.split('@')[-1]
           email_hash: md5(config['hash_seed'] + owner_email)

Then you can set

TAP_CSV_STREAM_MAP_CONFIG_HASH_SEED='...'