CPIO is unfamiliar outside Unix, and several slightly different variants exist. TAR preserves Unix file permissions and is expected by many developer tools. CPIO is at home in linux boot images and package payloads; TAR is the usual choice for bundling files on Unix systems.
A password-protected archive is refused, since its contents cannot be read without the password. A plain TAR does not compress anything, so expect it to be about as large as the files inside; TAR.GZ and 7z make smaller files. CPIO files are read, not installed or mounted: every file inside is unpacked and repacked into the TAR, so nothing of the system image or installer is run.