Security
Tokens
There is no limit on Filters used on a Token, every Filter represent a standard PHP or WP Function.
Maybe your Security programs (like JetPack) could alert you about:
The file DCE_Tokens.php contains a malicious code pattern. Threat found (PHP.Cookie.Eval.1) This code pattern is often used to execute unauthorized programs on your server. The code in these files needs to be reviewed, and possibly cleaned.Threat PHP.Cookie.Eval.1 found in file: /wp-content/plugins/dynamic-content-for-elementor/class/DCE_Tokens.php
if you look at the code you could find it:
if ($afilter == 'eval') { echo 'EVAL is not a secure function, please do NOT use it.'; continue; }
So it's absolutely safe, because we prevent the use of EVAL function.
PHP Raw
The most powerful Widget it could be also the most dangerous.
A dirty code can broke your page...hey, but with great power comes great responsibility!
We remember that also in Wordpress core is possible to write PHP code from backend Theme and Plugin Editor.
Worried about it? Simply disable this feature from plugin configuration.
https://docs.dynamic.ooo/article/99-how-to-enable-disable-plugin-features