Not paranoid. There are many undocumented binary blobs. I wouldn't touch this project. Not worth he risk.
Check the "Binaries" section. This was addressed in an issue:
https://github.com/ventoy/Ventoy/issues/132
Not sure how comprehensive that list is though.