Couldn't one set the path of cookies to be for your app? Then a malicious plugin shouldn't be able to read your apps cookies, since they won't be sent to Wordpress
Most web frameworks use encrypted cookie storage by now, right? Without the server key those cookies are useless.
Not if someone takes the cookie and just passes it back to the app from their own browser to steal someone's authentication.