Short: yes, it's safe.
If in doubt, you can check out EDMCs source code and compile it yourself from GitHub.
Slightly longer: that's the reason for the login at FD's API server. This way, EDMC (or INARA) don't need to know your credentials.
Oh, and that wasn't the FD server that remembered your login - that was your browser.