@hypolite I wasn't really thinking about SQL injection, I was thinking about malicious JS code getting written to the front-end and executed by an add-on that just uses a hook that injects it somewhere in the page code like the head, footer, etc.

I tested this by entering an annoying JS script into the text field and saving it. Where the add-on displays the user text from that setting, sure enough it wrote it <script> tags and all into the page and executed it. That doesn't seem like something that should be possible to do.