Network requests have to be accomplished by sending a Cmd to the Elm run-time, so any library that wants to send data to an external party has to go through you. That makes it easy to at least inspect the code that is producing the Cmd and check that it isn’t sending something malicious out.
The only exception to this is that a library can also produce HTML that can have side effects when rendered, but that is still pretty easy to inspect. You can see more here.