I mean, if you never let the launcher connect to the internet, then it can't really do any harm, right? Certainly even more so if you dont give it any access permissions. If you make sure you're using a launcher that has various recommendations, is open source and is perhaps even designed with privacy and security in mind, I doubt you need to worry to much. Its highly threat model dependant though. I dont know enough on the the subject to know if there has ever been any kind of security issues related to the subject, so this is just opinion.