A Friend slacks a lot AND it was on OSRS, while OpiaCows is for RS3 ;)
Also, I assume he needs the 17m cash for a bond, and there's no way OSRS bonds are 17m.
Such a bot is not for release lol, it would cause the economy to shift like crazy.
In general, good moneymaking methods are watched more to see if someone's botting them.
Quests/ban record/login screen/untradeables/...
Also, you're better off hiding more things like your total xp and some levels. I know your RSN just from looking up your total xp on the hiscores.
While I certainly understand you're worried, you have nothing to fear. There's no sane reason why a bot developer would steal its users' login details... RSGP is only worth a small amount, accounts can't be sold because they can be (easily) recovered, etc.