Didn't some get exploited early on because electron made it trivial to load third party websites without any kind of XSS protection?