For one thing, command-line arguments are public information about processes in every OS since forever. Putting security-sensitive information there is a fault

For one thing, command-line arguments are public information about processes in every OS since forever. Putting security-sensitive information there is a fault of its developers, not Discord. For another, Discord spies on the system to report what games you're playing, including which mods. It's a cool feature for some, but indeed requires a set of abilities that are indistinguishable from malware.