(author)
Thank you for your feedback. This template has not yet been reviewed but I hope to get candid feedback like yours on spots that may have been missed.
I am planning to change the way the IPC renderer is exposed; Marshall from the Electron team pointed me to a better way of doing so and I hadn't had time to update the repo yet. That will be something I update soon in the code and in the docs.
The best practices I take from Electron themselves; https://electronjs.org/docs/tutorial/security. If there are other security reports please send them to me and the template can be enhanced further.