No, they don't have access to the Wireguard keys and everything is point-to-point. They'd have to push a backdoored software update to gain access (and this is a threat with any vendor product).
No, unless combined with WebUSB trickery, and such an attack has been possible in the past. However, browsers currently implement blocklists of HIDs and other USB types from working with WebUSB.
If anyone is interested in Electron application security, I wrote a guide that explains the methodology behind some of the choices the author here has taken and even goes a bit further in a variety of areas: https://know.bishopfox.com/research/reasonably-secure-electr...
I've used nsshell to great effect on multiple projects, highly recommend it (but an encrypted option would be great rook). I've also written a more heavy handed asymmetrically encrypted DNS C2 https://github.com/BishopFox/sliver