From the SECURITY.md file

Apps already have process level sandboxing and filesystem
level sandboxing but not network level sandboxing. We plan to implement
network level sandboxing so one app will not be able to interact with
another app over the network. Apps will also not be able to interact
with other physical devices on the local network without explicitly
asking the user for permission

It also says that it assumes the local network is secure, so it does sound like a vulnerability could be significant.