The only security change is a policy one that did not need to be bundled with the rest: you can't load external code and run it in a privileged context like the background worker. However you can still load it into a frame and communicate with it.