Yes the app itself is closed sourced, but FWIW their MicroG fork is not: https://github.com/YTVanced/VancedMicroG

Their stance on why they can't open source it sounds reasonable: https://github.com/YTVanced/VancedWebsite/issues/10

But I agree that if you have sensitive data on your google account you should make a value judgement yourself on if the extra convenience/features on Vanced is worth the risk over NewPipe.

I personally use a different mail provider so I don't have much sensitive information on my Google account, basically just using it for YouTube and Play Store.