The authorization token here is not a cookie. RFC-7235, which defines the Authorization header, states that:

The HTTP authentication framework does not define a single mechanism for maintaining the confidentiality of credentials; instead, each authentication scheme defines how the credentials are encoded prior to transmission.

So it depends on the specification of Bearer, which is RFC-6750. It states:

TLS is mandatory to implement and use with this specification.

Which tells me that it should be possible to retrieve it and more importantly, not using TLS here is a vulnurability.

The authorization token here is not a cookie. RFC-7235, which defines the Authorization header, states that:

The HTTP authentication framework does not define a single mechanism for maintaining the confidentiality of credentials; instead, each authentication scheme defines how the credentials are encoded prior to transmission.

So it depends on the specification of Bearer, which is RFC-6750. It states:

TLS is mandatory to implement and use with this specification.

Which tells me that it should be possible to retrieve it and more importantly, not using TLS here is a vulnurability.