I'm not sure how the bot does it but the best way to prevent unauthorized usage of your API, if it's your account, is to whitelist the IP address on where the orders are coming from. In this way, it would be safer. I don't know if the bot does that but Gunbot does it very well.
Good point. it's not like the bot is whitelisting the IP address. When creating an API key on binance, you can protect it with an IP address, so that binance will not accept orders from others even if he has an API key. The problem is that it doesn't help if the bot is not open source, because it is enough that it is programmed in its code to launch an attack on day X at time Y on trading pair xxx/BTC and, using your machine and your API address, it sends an order to binance using your API key. My point is that when using this bot you have to TRUST and BELIEVE that you won't be robbed because they have tools for it (unless the bot is open source and you have checked every function)