It seems like the id token is used as access token/api key?

As there are so many discussions that storing tokens in a palace reachable by JS is very insecure [02]. I'm wondering what I'm missing here.

Also, I do not really understand why is it considered to be so much more insecure? As soon as malicious code has access to the JS, he can as well make the fetch requests from the users browsers, sending along all the required cookies.

So, is it still valid not to use local storage for tokens?

[01] https://firebase.google.com/docs/reference/js/v8/firebase.User#getidtoken

[02] http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/