Apparently, The Github CLI only stores its oauth token in the HOME directory if you don't have a keyring. They also say it may not work on headless systems. See https://github.com/cli/cli/discussions/7109.
For example, in my macOS machines the token is safely stored in the OS keyring (yes, I double checked the file where otherwise it would've been stored as plain text).
The defacto install of github CLI on ubuntu systems appears to be snap which is owned by some random dude...
Yes. KeePassXC is all you need on Linux to have a compatible secret store.