It's running in a sandbox afaik, and the goal is to replace Flash but stay secure. Since it uses Web Assembly, you can't use Ruffle in any way to create any security threat, you couldn't create without using Ruffle. (Different to Flash, which created tons of new security threats, even leading to the plugin being disable).