You are right: it's easy to implement a wallet to steal user's seed.
If you are a developer, you can:
write your own wallet and trusting your own code.
read and understand the code written by a third party and put your trust in it.
If you aren't a developer, you must put your trust in someone else's code. You must educate yourself by reading forums and ...
Your goal is to instruct Bitfinex to broadcast a transaction to the tangle. One that sends the IOTA balance Bitfinex is storing for you (under their seed) over to an address generated under your seed.
What is a seed
A seed is the password you use to manage your balance on the IOTA network. This network is like a database of password-protected balances ...
The issue was I had Python 3 installed @ ~/miniconda3 so even thought I was running the install script with Python 2.7 something else, I think electron, was referencing the Python on my path or something like that which was Python 3.
I rm -rf ~/miniconda3 then rm -rf node_modules and its working.
Currently, it is safe but due to this not being an official script from the IOTA foundation it can be modified and changed to try and phish users.
Before running or downloading the script you should always check the GitHub for it and see if it has been modified for a malicious purpose.
A wallet should be open source -- this way, it can be vetted by the community to ensure there are no loopholes or trojans.
Aside from that, you should look to the community and determine which wallets are used, for what reasons, where they come from, and their track record to determine which wallet you want to use.
First off, you don't store IOTA in KeePass, KeePass is a password manager and is unrelated to IOTA. IOTA is stored in the Tangle, which you can access using a seed and a wallet.
So the steps for withdrawing your IOTA from Bitfinex are the following:
Install IOTA light wallet following this guide: https://iotasupport.com/gui-lightwallet.shtml
first some warnings:
Never give your seed or your recovery phrase to anyone! They will steal all your cryptocurrency token / money! We will never ask you for this information!
Take care, because if you use it, the seed gets exposed outside of the Ledger device, which defies the purpose of having a hardware wallet at all.
muXxer a valuable IOTA Community ...
The best way to generate a Seed is via Keepass (Windows) or KeepassXC (Linux).
Very important is to change the seed after creation, so you don't fully rely on the generation algorithm. The advantage over the Linux terminal is, that you don't have to copy/paste it. You can store it directly and safly in Keepass.
For newbies I recommend following sites: