Putting secret information in a URI is explicitly called out as a bad idea in the very RFC you reference:

> URI producers should not provide a URI that contains a username or password that is intended to be secret. URIs are frequently displayed by browsers, stored in clear text bookmarks, and logged by user agent history and intermediary applications (proxies).

https://tools.ietf.org/html/rfc3986#section-7.5

As an aside, if you're going to be making any security judgments from an RFC, every RFC since RFC2223 has a Security Considerations section. You usually want to start there.