Yes, but this presumably still runs on top of DNS and SSL and an attacker can exfiltrate a bearer token all the same if they pwn your machine. What this does is

Yes, but this presumably still runs on top of DNS and SSL and an attacker can exfiltrate a bearer token all the same if they pwn your machine. What this does is make the only viable attack vector the one where they're on your machine or getting you to unwittingly run stuff on their behalf on your machine.