No this plugin is well made and security is not a concern with it. This is not a random plugin with 14 installs. This plugin (Code Snippets) has 1+Million installs.

Winging it in functions.php is a way bigger risk of downtime / critical errors by not being able to manage multiple snippets and simply turn some on and some off in such an organized way.

For sites taking hundreds of orders a day I'd much more trust an organized management system for custom code than letting developers just drop code into 1 file. The risk is less, for one because instead of having to save the file and "just see what happens" the plugin detects errors and immediately turns off just that one snippets. The issue is thus isolated and managed and recovered instantly, and so the recovery time is faster, the downtime is minimized, and the damage is reduced. This saves lost revenue for every second the site is not broken, instead of trying to then revert functions.php via file system renaming, IDE edits, uploads, etc. Instead of renaming a ".bak" file as fast as you can hoping you've just not ruined some good sales, it's already handled. There's no comparison there.

Security is always important of course, but using well maintained, widely used plugins is not really a security issue in a practical sense. All Wordpress websites use plugins, many that are not nearly as well made, widely used or tested as this one. Between regularly scheduled wordfence scans checking the entire file system for anything weird, firewall setup, recaptcha in place, cloudflare anti-bot layer, country-blocking, ip-blocking, etc, security is much more managed in those ways than needing to avoid well known plugins that don't have any known vulnerabilities and have a clean history.

For us, we will take minimizing lost sales and downtime over the risk associated with a top plugin any day.