It's good that you're asking the question and to be wary! I made sure when putting together the TODO Progress Bar components that it was 'read-only'. It should only have access to read the block's children and the associated page names
It makes no external calls (to be honest I haven't had a reason to learn how to make external calls with Clojure yet)
I went the JSON import route to make install of the extension easier, there is no auto-updating and the code can not be externally altered after installation. After the JSON import you can see on the bottom of your Daily Notes page what pages have been imported/updated and whatever code has been added is on those pages. No code will run until you explicitly open the extension.
This particular extension is not a javascript extension (roam/js) it's written in Clojurescript (roam/render). I haven't looked into if that is supported by David and roamjs.com
There is of course always the possibility of me making a code mistake (I've been building these roam/render components as a way of learning Clojure) but the worst that would happen would be a slow page load which could be fixed by removing the extension in