Their stance on why they can't open source it sounds reasonable: https://github.com/YTVanced/VancedWebsite/issues/10
But I agree that if you have sensitive data on your google account you should make a value judgement yourself on if the extra convenience/features on Vanced is worth the risk over NewPipe.
I personally use a different mail provider so I don't have much sensitive information on my Google account, basically just using it for YouTube and Play Store.
But.
NewPipe allows downloading the videos which is great. Sharing video function in Vanced allows using NewPipe for download directly from Vanced application.
There is also Bitchute and Hooktube, if you want to get at Youtube videos without using Google more than absolutely necessary.
Also, on my experience, some Youtube ads are served through the same domain that serves the video so you won't be completely ad free.
Isn't it funny how one man's feature is another man's bug?
Not supporting logging in with a Google account to keep subscriptions and history synchronized across devices is exactly what disqualifies it from consideration for me, and I suspect I'm not alone here.
For those like me there's YouTube Vanced, which is almost an exact clone of YouTube except without the ads, allows you to disable a bunch of distracting "features" like info cards and watermarks, and with the ability to use MicroG in place of Play Services for the actual logging in with Google feature: https://vanced.app/
Isn't it great that we both have the ability to choose the YouTube replacement app that works best for us despite Google technically "owning" the platform though? This is why I love Android. (EDIT: Re-read this and realized this could be seen as inflammatory. Really did not mean to start a platform war. Just glad that Android is a choice that's available to those who value this kind of thing.)