I tend to disagree. The fact, that a browser engine and JS is involved raises the bar significantly during security audits. It brings additional third-party players into the chain you have to trust. Meanwhile I suggest to read https://xtermjs.org/docs/guides/security/.