Token refresh is saved on block configuration

Problem/Motivation

I am evaluating the module for using it with just the token provided by the customer and I noticed that the token refresh is saved back in configuration, in the settings of the block. This seems odd as configuration should be something deployed from a code repository without having to check if an automatic process changed some bits of it.

The code is in
https://git.drupalcode.org/project/instagram_lite/-/blob/1.0.x/src/Hook/...

Steps to reproduce

Configure a block with a token and refresh the token with cron. Configuration is changed.

Proposed resolution

Maybe I'm missing something of the workflow of the module and doing something wrong. I believe state API should be used instead of config. Maybe using the UUID of the block as the key of the storage.

Remaining tasks

Code

User interface changes

API changes

Data model changes