That's fairly paranoid considering that any VI, even when running in a PPL is basically still executing inside the same process. There are a lot more things it can do that could be much more dangerous, but you have to strike a balance between security and performance. Starting to isolate each PPL completely from the rest of the system would take up a huge amount of development effort and also cause a lot of performance loss. You wouldn't like that at all!
VI server has some strict limitations when it is operating across LabVIEW contexts but limiting it even inside the same context would be to restrictive and it would also mean that you have to consider the entire scripting interface in LabVIEW as very dangerous.
And yes if you use PPLs they could be swapped out by an attacker. But if that is really your concern you may have a lot of other more grave trouble. Who lets such a person even have access to that computer? Why would they attempt to attack a PPL on that system when they can have the entire cake and eat it too? It's many times easier to attack DLLs, yes even with signed DLLs, and take over the entire system, than trying to hack into a PPL with its proprietary format and only get a crude control over a single LabVIEW application on that system.