It appears all the documentation is incorrect regarding the procedure for obtaining application credentials in PowerShell Before/After scripts for IQService.
Looking at the raw XML provided by the IQService in the application environment variable, the credentials are base64 encoded, and they also contain a newline in middle.
I have observed this on both the Active Directory and Entra ID connectors.
After joining the parts to form a complete string, we can base64 decode it into a binary array, but I assume it needs to be decrypted.