Well, if the repo is public anyway, yes, that is true.
As far as workarounds, I do understand it’s not awesome, but may unblock someone less savvy than you to use the pattern I mention in this post (specifically the SECOND instance of #3 in the numbered lists). “save a short token, use it to fetch the longer one during build”. You do then have to, well, “deploy” it, during build - it wouldn’t be an environment variable, but embedded in a file or something similar. But, that keeps your token out of the public repo AND out of the variables sent with the function.