There is no need to suspect something or not. Everything is defined in Type-C specifications. Use the common rule of engineering: Read specifications.
Yes, the main problem is with “legacy cables”, Type-A plug to Type-C in particular. The Type-C specifications define the primary mechanism of how the consuming port (phone/tablet, or Upstream Facing Port, UFP) detects source capability.
If a standard C-C cable is used, the supplying port (Downstream Facing port, DFP) “advertises” its capability by using three different pull-up resistors on CC pin. If a 5V pull-up reference is used, these values are 56k, 22k, and 10k, for port’s capability of 500mA, 1500mA, and 3000mA correspondingly. The CC wire propagates this information from DFP to the end of Type-C cable. The connected device (phone) will (should) detect this, and limit its consumption accordingly.
Now, what to do if you have only a legacy Type-A port on your host, as most PCs do? The Type-A does not have any extra pins like CC. The Type-C Specification suggests embedding this information into the Type-C end of the legacy A->C cable. Therefore, the “information channel” is broken now, and the phone will try to grab as much current as the pull-up resistor inside the Type-C overmold indicates, which is soldered by cable’s manufacturer. Since the cable does not know which port you will plug it in, the safe cable pull-up should be 56k, otherwise the phone can try to suck 1.5A or even 3A from the cable. If the port is a regular USB, the requested cable power may vastly exceed port's capability. With cheap uncontrolled power delivery (some cheap PC mainboards connect the VBUS directly to internal +5VSTBY), it will cause system shutdown.
If the port is powerful enough, but the cable in use is skinny (Type-C cables can have as low as 28AWG on VBUS and GND wires) and the C-connector has wrong 10k pull-up, the cable might burn out and cause fire.
P.S. You can measure the pull-up value of CC-to VBUS on any A-C cable by using a breakout connector like this one: link
The devil is in the details.
"Is a USB 3 Type A-to-A cable dangerous with USB 2 ports?" The emphasis needs to be on the specifying of a USB 3 cable.
A USB 3 compliant A-to-A cable will not be dangerous if used with USB 2 ports because a USB 3 compliant A-to-A cable will have only the ground contact of the USB 2 contacts connected. The D+/D- and +5v wires are not used in a USB 3 A-to-A cable and are specified to be unconnected to avoid damage to USB 2 ports.
I suspect that the A-to-A cable used for this hub is not a compliant cable because the hub will need power to operate. Without the data wires connected the hub will be unable to be used with any USB 2 devices. It's possible the hub gets power from someplace other than the USB cable to the computer but if there's no power brick required to make the hub work then it's cable to the computer must be providing power, and that would make it a noncompliant cable.
If USB 2 devices work with the hub then that's another clue it is not compliant with the USB spec. It's possible that the USB 2 data is somehow being sent over the USB 3 data lines but this is a function that is not defined in the USB spec, there would have to then be drivers installed for whatever logic is in the hub so the computer would know to look for USB 2 devices on the USB 3 data lines.
If a USB A-to-A cable does connect the +5v contacts on both ends of the cable then using it to connect two computers will hopefully just trip a self reset circuit breaker in the port on one or both computers. In some computers this can burn out a fuse or circuit board trace in the port, which would be permanent damage but not leave the port useless as devices that are powered by means other than the port should still work. Such devices that don't rely on USB power would be something like a printer. Another outcome could be the power supply protection trips and the computer shuts down.
A worst case would be something like the USB chip controlling the port being destroyed. With many computers today having a single chip for all USB ports this means the keyboard and mouse going dead. That would likely make the computer effectively dead and worthless.
Best Answer
Yes, it's safe. The base connector is identical to the original Micro-B, only adding the USB 3.0 data send/receive lines on the side. (USB 3.0 is backwards-compatible with 2.0, and this applies equally to all connectors it introduced – both the full-size and micro-size, type-A and type-B ports).
The end result will generally be the same as if connecting the drive to a computer's USB 2.0 port (which doesn't have these extra pins, either) – you'll be limited to the speed and power that USB 2.0 allows and won't be able to use UAS, but it should still work properly otherwise.
The extra pins are differential signal pairs (RX+, RX-, TX+, TX-, ground). Compare pinouts for:
Be sure to use a decent cable though, as magnetic disks will probably need the full 500 mA that a USB 2.0 port normally provides. Original phone cables should work fine (modern phones draw several times more anyway), but some cheap replacement cables might be unable to power the HDD at all, or it might repeatedly shut down while in use.