Translations in source code

This is “normal” in WordPress 5 as this is what the new wp_set_script_translations function is for.

The function tells WordPress to associate a JSON file containing translations with a specific script that will make use of them. It makes use of them as you see, by embedding the translations as JavaScript objects.

You say this is not secure, but you don’t say what you’re concerned about. I would say it’s as secure as any file you allow onto your server. You install PHP code from trusted sources and allow it to execute. Likewise with JavaScript. So apply the same caution to translations and don’t install language packs from untrusted sources!