Are the icons reused over restarts? In that case a cache is what you want.
Where is this file deleted?
The file is created and filled with a FileTransferJob. Setting the file permission after the job has finished does not help privacy. Please set the permissions on the directory.
Set strict permission on the tmp directory. This way each user needs his owm tmp directory or else only one user could use KDE Connect on a system,
because sharing the tmp folder as before will be impossible.