they specifically address this in the article; the objective is to be able to treat the component as untrusted code (the same as a website's js) and sanitize/ch

they specifically address this in the article; the objective is to be able to treat the component as untrusted code (the same as a website's js) and sanitize/check the component's output (the same as web APIs called by js). Corruption is not an issue when you assume the corruptee to already be an attacker