One of them requires the user to click run on a file, much like running an EXE. The other, simply saves potentially malicious data to external storage which would then have to be run by a separate malicious third-party app. This are far from RCE exploits that execute immediately without poor user decision making, and Rust is not impervious to security exploits similar to these.
But if not addressed to me, there is no need to pay, you can start here: - https://www.electronjs.org/docs/tutorial/security - https://github.com/electron/electron/security/advisories
As you can see there are plenty of considerations and pitfalls to take into account. Best option is to enable contextIsolation for everything.
Further, Electron security is closely tied to Chrome security so that is one deep rabbit hole