As mention in the comments this is due to a GHAction feature that prevents tokens and secrets from being passed as outputs.

With that information I managed to find a workaround that proved helpful to me.

Basically, you can set the token as outputs if you base64 encode it twice first. and then base64 decode twice in the caller workflow before using.

My solution ended up having two reusable workflows:
Token Retreiver(TR): Retreives the token and encodes it.
Token Decoded(TD): Calls TR and returns the decoded token to the caller workflow.

Then I just call the TD from my caller workflow.

This does send the token decoded between jobs so only do this if that is not a problem for you.

You can find an example here where I found the workaround: https://github.com/orgs/community/discussions/29880