The same security restrictions and exploit protections apply to any third party app you install, no matter if you deem it "sketchy" or not, or whether you obtained it from a reputable source or not. Instead of seeking an answer to the question “Could the mod steal data from other profiles if it were infected?”, try to answer the question “Could an app steal data from other profiles?”
As far as I know, the answer to that question is no, as long as you don't do anything out of the ordinary.