Assuming the codex editor is the editor for the area below the auction counter, isn't that a security vulnerability that can put the site audience at risk?

The Codex agent is only given tools to edit the single HTML file that displays on the homepage. The page is on a separate domain, so there's no cookie sharing, and the iFrame is in a sandbox. That said, the biggest risk is social engineering attacks.