ESP8266 / ESP-01 - Customize the NonOS "at" firmware of SDK?
Why don't you just do everything on the ESP? There's no reason to use the AT interface and add a second microcontroller.

Having said that, I wonder how information gets into your MCU in a way that doesn't make it accessible to an adversary.