Sadly I've barely been writing shell scripts for multiple decades, so needed to look this up.

> If an attacker pre-creates the file with relaxed access permissions, then data stored in the temporary file by the application may be accessed, modified or corrupted by an attacker.

https://owasp.org/www-community/vulnerabilities/Insecure_Tem...