Anytime you use your nsec in an app, it involves a degree of risk. That's why we have Amber and brower signing extensions. But it has been my experience that using the signing extention option in Cashu doesn't work. It has some sort of bug that produces errors and doesn't properly authenticate. But the nsec option does work, and I don't think it's any more or less risky than using it with any other app.