Even without disabling Gatekeeper and SIP it is possible to insert malicious code into the OS somewhere because of full read and write access to the home directory and what not.

You could run the application in a VM without networking capabilities.