Delete sensitive information on Power Query phase - is it still included in the .pbix file?

AFAIK the data model will only contain data that you specify as an output from Power Query. So, if you import a file with a sensitive column, and remove it during transformation, then it will not be stored in the saved workbook.

If intermediate steps were stored in the workbook then your workbook size would be much larger than it needs to be, and some data models are pretty large in their final state without having to worry about what's in there during the transformation stages.

Think of Power Query as a recipe card for your data transformation - when you're preparing a meal, there's thiings to be done at each stage, but you're only consuming the meal at the end. In Power Query, each step dictates what needs to be done to the data, but only the state of the data in the final step of that query will be persisted into your data model, as that's what you're using when you do your analysis.

Power Query will cache data on your machine for faster previewing, but this is not stored in the workbook itself.

I agree with LivioLanzo though - if you're really that concerend about that column, then it never hurts to try and head it off at the source, so if you can get an export (or direct query) from your DB then that will ultimately be better. The CSV file existing in itself is a potential security issue if not adequately locked down.