It's enough for just a single direct or indirect dependency to be compromised to have a botnet or turn it into something used for surveillance against the users.
Preventing it from exfiltrating data by isolating it from the network with Internet access is the only option if you want to run it. This requires local only devices.
It has access to security cameras and having to trust a ton of code downloaded with Docker is a no go.