It’s a toy tic-tac-toe game with no monetary or life threatening implications, no need to bring the security mindset into this discussion.

If someone copies this code and uses it in a non-toy application, well, that’s on them.