Sort of a click-baity headline... if it had just said "iTerm2's SSH integration on MacOS is not safe", a user such as myself who doesn't use that particular terminal or OS wouldn't need to visit the article.

(Not blaming OP -- they just used the linked article's headline.)

iTerm2 sends a remote bootstrap script, the conductor, over the existing SSH session.

Just don't use malware. It's that easy.