That’s for the artifact upload, to communicate with the artifact API (bitrise.io).
No, but the link includes a per-artifact slug in the URL, which is also combined with the ID of the artifact. Guessing this URL is harder than guessing a standard password. These install pages are not indexed, so it won’t leak to Google either, unless you post it somewhere public.
Another option is to not to use the Public Install Page, and instead download the artifact/app from the build’s page. That way only those can download it who are in your app’s team on bitrise.io
You can turn off the Public Install Page option in the Deploy to Bitrise.io step, by setting the Enable public page for the App? option of the step to false.