Yes, the new worker node will execute the global init script independently when it starts.
It does not get the package from the driver or other existing nodes and will hit the configured index URL directly, and try to download the package on its own. Therefore, every new node joining during autoscaling will invoke the index URL to download the artifact/package.
Regarding the second question, it depends on how your global init script is written.
If you pull the credentials from Databricks secrets every time the script runs, then the new node will get fresh credentials, but if the driver fetches the credentials once and writes them to DBFS or environment variables shared across nodes, then new worker nodes may use stale credentials.