They mention they’re only doing things locally, and looking into using tailscale, so they aren’t exposing to public web and the security concerns you mention are a lot less important.