systemd's method does not require the service process to have access to the original creds file, or even the filesystem that contains it. In fact the original credentials file might even be an encrypted file and the key (and/or hardware) to decrypt it does not need to be accessible to the service process.

You completely misunderstand.

The library the person linked is to deal with systemd credentials in go.

The two lines of code I wrote are the same, and in fact are effectively 100% of the code in the library.

Oh I see.