Privacy: Reuses existing provider sessions — OAuth, device flow, API keys, browser cookies, local files — so no passwords are stored.
macOS permissions: Full Disk Access for Safari cookies, Keychain access for cookie decryption and OAuth flows...
It's excellent this is disclosed as a reminder of how things work and the tradeoffs you're making to use it.