If you have a concrete security/policy concern, you should say what it is (e.g., "I'm having trouble getting the LibreOffice extension approved by my institution because a security scanner is flagging the outdated library"), but there are no "obvious security reasons". The library as used only gets input from the Zotero process itself, and only parses JSON — there's no actual exploit path. We can look into updating the library, but there are no security concerns here.