Is the DESelect Search in SFMC - Salesforce Marketing Cloud secure?

Yes, it is.

Marketing Cloud permissions

The DESelect Search in SFMC - Salesforce Marketing Cloud uses your current Salesforce Marketing Cloud session to perform searches using the Salesforce Marketing Cloud API.

This means that the Chrome extension can only work if you are currently logged in to Salesforce Marketing Cloud.

It also means the users' visibility is respected, one can never find things through the DESelect Search in SFMC - Salesforce Marketing Cloud the user would not be able to see otherwise.

Also, note DESelect Search in SFMC - Salesforce Marketing Cloud does not store any data, it just passed the search query through the SFMC API and returns name and location of the results.

It also doesn't look at any content. For example: when you search for a data extension, DESelect Search in SFMC - Salesforce Marketing Cloud only returns the name and location of the data extension, it does not look at the data in a data extension.

Google Chrome permissions

You may have noticed that the DESelect Search in SFMC - Salesforce Marketing Cloud requires permission to 'read and change site data'.

DESelect Search in SFMC - Salesforce Marketing Cloud does not modify any site data, it only needs to read the URL of your browser to detect if you're logged in to SFMC. Unfortunately, there is no way to make it clear to Chrome that only 'read' permission is needed, the only available permission is 'read and change'.