Is Heroku's .netrc file safe from infiltration by other programs? How does Heroku ensure that its tokens can't be used maliciously?

Question

If Heroku\'s .netrc file can be accessed by simply running

cat ~/.netrc

and exposing the tokens, how do they ensure that the tokens can\'t be