[sigzero]

"As long as you don't load untrusted code or content..."

Because end users are soooo good at that?

[AgentME]

They're referring to the application developer.

If the developer uses Electron only to open the application's own html files and doesn't render user-provided HTML anywhere, then there won't be any XSS vulnerabilities.