Note that the MS docs say _popen only works from a console application. I would probably explicitly open in binary mode if reading non-text data like in this article.
Allocating 1 MB on the stack for the buffer is also something you may have to be aware of in certain environments.
Someone needs to make something like this that also avoids using the shell. Like posix_spawn.
In other words, the argument list needs to be an array, not a string, to save the user from invoking the shell with improper quoting. A command is fundamentally an argument array, and saving the user from having to concatenate this into a string, just so the shell can undo it, avoids an irritating, error prone and unnecessary step.
There is boost process: https://www.boost.org/doc/libs/1_76_0/doc/html/boost_process/design.html#boost_process.design.scope
But that is still a wrapper around os functions.