As DocGen generates document client side (in the browser) there is a need to re-upload the document somewhere in Tuleap so it can be fetched by OnlyOffice.
The temporary end point is exposed by DocGen plugin and is only accessible to the user who is at the origin of the action. The document cannot be viewed by someonelse (no "collaborative reading").
There is a regular job that clears all the temporary files that have more than a few minutes of existance (no longer needed as they were already fetched by OnlyOffice).