I've found some places say localStorage is insecure, but both OWASP [0] and MDN [1] say it isolates by origin. Third party scripts from different origins shouldn't be able to access it, but a successful XSS attack could have access.

[0] https://cheatsheetseries.owasp.org/cheatsheets/Session_Manag...

[1] https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage...