I suggest you bring this up in an office hour with the security review team and see what they suggest.
Usually the risk is very low if your connection is secured HTTPS from a theoretical perspective. In theory HTTPS connection does encrypt the url parameters.
However the risk is high in practice if you are calling these via a client side JavaScript. The users browser can be compromised.
Example in the browser if screens are recorded then one can see the url Params or in the browser history this will show up and the credentials are then compromised.
Also logging them in the sever can be risky. If server is not protecting these logs and they show up then this is a risk.
However if you are doing it in apex and your secrets are in protected custom metadata or settings risk is significantly low.
I would personally move to POST to mitigate some of the above risks.