It can also be subject to MITM. If you don't control the certificate store on your device then you don't control the connection to Guacamole (or anywhere else via HTTPS).
Basically any attacker that is able to control the certificate store on your device could also just install a keylogger.