According eosjs documentation
Using the JsSignatureProvider in the browser is not secure and should only be used for development purposes. Use a secure vault outside of the context of the webpage to ensure security when signing transactions in production
I understand that the browser has a shared context that browser extensions could have access to and leak the private keys, but how about a node application or an electron desktop app? Would it then be safe in this case to use JsSignatureProvider as is?