Safety is a relative thing. Nothing is completely safe. The idea with security is to make it complex enough to break through your security, which I hope is not worth the time and effort that will be required. It depends on how motivated the evil person is, which usually depends on the type of information being processed or stored or the services performed. You can compare it with installing a lock on the front door. Most gateways are not very secure in that someone who is trained to select / bypass them can usually do this very easily. But they do not allow the average person to choose to open your door only out of a random temptation or curiosity.
If the nature of the application you make is that it should be as secure as possible, then it seems to me that Electron is not the best option. People can view your code directly. Even if he gets confused, he still leaves them the javascript code, and, as @ Cenebyte321 noted, you can “decorate” it a bit. Although the decorated version of properly obfuscated code would not be clean or readable code in terms of the concepts presented to it. This would not be something close to the original. Otherwise, you can simply take any working code and make it readable and well organized by simply running the decorator on it. It’s good to understand that technically you can decompile any executable file back to the source code. Even a binary program written in C can be returned back to C code. In this case, the resulting "confused" code is likely to be even obscure, so there are some advantages to this. But still, it can be decompiled, and it must be a valid C code.
When malicious code is on the system, it is very difficult to protect. It is more important to make sure that all the servers that the application works with are safe (again, in a relative sense), and the API is safe for them. It should be safe enough if someone looks at the source code of your application and finds out how your server API works, this is not a problem for you. Any confidential communication with the server must be encrypted. You do not want the administrator username and password to hang in the source code. But you do not want any application to be written in any language.
Ideally, any passwords stored on the user's computer should be converted in some way before being stored (possibly salty in various ways and hashed, or whatever the children do these days), so that if anyone then gets access to this data, they see only a modified version. When this is done correctly, there should be no way to decrypt the passwords, although there are methods that people can use to try to create a password that will result in the same hash. You must compare the changed version of the usually entered password with the saved modified version of the actual password. The principles of securely storing passwords and having secure APIs and communication with the server are not specific to Electron, any language or structure that you use will require the same thorough security assessment.
Just in case, my words are misleading, I did not mean that the standard practice is to locally store the passwords used to access the server. Ideally, the user would have to enter passwords of this nature every session, and he would never be stored locally. But for convenience, many applications allow you to store a password locally, so you do not need to enter it every time. Indeed, it depends on how sensitive the data access to which these passwords are and how important it is for your users.
But if malware is running on your user computers, it is possible that they will still record their keystrokes and thus recognize usernames and passwords. Even encrypted communications are not reliable, as they eventually reveal security holes and develop new protocols. Sometimes governments or other people are aware of a backdoor that was intentionally designed as encryption. I just hope that no one has found these backdoors yet, since they are essentially security flaws deliberately designed into encryption protocols. As javascript tools become more advanced, it is possible that convoluted javascript code may be almost as obscure and confusing as convoluted C code, or there may already be tools that achieve this.