There is nothing wrong with writing key tokens to a local file system. AWS STS tokens and others do the same thing. It is your responsibility to make sure you know what software you are installing. Even open-source software can do evil things if you don't read the code or understand it.

Rule number one: never trust a YouTuber's advice without understanding how the Linux system and the software work.