This comment made me think that the date created being changed to the time of moving it into the vault might actually be the expected behavior, as the file is changing the filesystem (as the virtual drive with the decrypted files always has a different drive letter to the one from where the original file came from)?
I’m not an expert, but maybe someone can confirm this? If so I’d still be wondering why many people don’t have their date created changed.