Please explain the crowd how you verify the SaaS server side.
Electron is an abortion, that will eventually follow Active Desktop footsteps after its fashion hype curve dies out.
In any case, Electron based apps can do whatever user account they run under.
If it's in your browser, you can see the code it's running and the data it is transmitting. And you're only a single uBlock Origin (other other browser add-on) filter away from blocking it.
HTTP is simply the delivery mechanism for a self-contained WASM application. Just like it is the delivery mechanism for most native binaries now.