The Site Transfer Wizard is looking for a locally stored backup, in the Output folder, as opposed to a backup stored in the cloud.
The default Output location is a small security risk because it is a known location. It is protected by a custom .htaccess file, so it should be pretty difficult to get to. Your backup archive itself is a security risk, it contains the database access details, possibly FTP connection details if you're using the FTP layer, hence the warning. Since you normally store your backups on cloud sites, it doesn't fully apply to you.
Dale L. Brackin
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
My time zone is EST (UTC -5) (click here to see my current time in Philadelphia, PA)