Is this a secure way to sign and publish a transaction or can the node intercept the private key?
What do you mean "intercept private key"? In that example the key is in the code, so your node process obviously knows it. If you are working on backend, then your whole codebase should be perfect and you need to always check the news for potential zero-day vulnerabilities, it's often enough to have just one vulnerability to give attackers full access to your servers and steal everything from hot wallets. This is why Bitcoin services keep most of their funds in cold wallets.
