If it isn't client / server architecture there's no privilege separation using SQLite either. The storage format isn't the concern. Rather, the concern is it all runs in the same OS security context.
But if it starts being a system of records / authoritative system, there needs to be a plan to decommission it.