The difference is that no-one would load remote-user-supplied C++ code at runtime and expect it not to result in vulnerability, but people remotely source JS, o

The difference is that no-one would load remote-user-supplied C++ code at runtime and expect it not to result in vulnerability, but people remotely source JS, or allow remote-user-supplied HTML to interact with their JS, and the stakes are higher than they would be in a web browser, because Node (and therefore Electron) has APIs to e.g. read and write to your filesystem and browsers have sandboxes to block that. (Electron offers sandboxing too, but you're likely to actually want to use the OS features so it's not as simple as always disallowing the access.)