The level of security seems to be on pair with Electron apps running inside macOS sandbox. Even if the attacker manages somehow to inject and execute a script on the client side, it will have access only to the files that user has opened with the app recently, not the entire filesystem.