Hacker News Reader

Which is a massive security issue in itself--Electron documentation even warns you about this.

Electron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.

Do most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?

The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.

FileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader

So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.