Should preload.js be made secure?

[srymh]

https://www.electronjs.org/docs/tutorial/context-isolation#security-considerations

Security Considerations

Just enabling contextIsolation and using contextBridge does not automatically mean that everything you do is safe. For instance this code is unsafe.
...
It directly exposes a powerful API without any kind of argument filtering. This would allow any website to send arbitrary IPC messages which you do not want to be possible. The correct way to expose IPC-based APIs would instead be to provide one method per IPC message.
...

[srymh]

For now preload.js is copied from here:

electron/electron#9920 (comment)

[srymh]

No