Doesn't that basically apply to all binary executables? Anything new and unrecognised by the scanner.
https://github.com/oobabooga/text-generation-webui https://github.com/AUTOMATIC1111/stable-diffusion-webui
If you have concerns or doubts about telemetry or spyware, there are countless software options available for detection. Give it a try.
So yes, the app can certainly harm the OS, and the venv would not provide any protection against this.