No, there is no vulnerability created because each HAF app is isolated to its own set of tables (its own schema). Each haf app runs as a separate role (like a separate user on a multi-user computer system), so it only has permission to write to its own tables.
About the worst thing that can happen is that a HAF app may be implemented inefficiently so that its queries are slow, slowing down access to the database to other apps.
But this can be mitigated by the new query_supervisor which kills queries that take too long or use too many resources. And if a HAF app adds too much load, HAF server operators will likely disable it until the app's devs make it faster.
This is good to know. Thank you very much for the explanation.