csv feed – is it safe?

I am working on updating a D6 site that hasn’t had security updates for literally years. I am moving the content all over to a D7 site.

It has 1000-ish users with different roles and I am thinking of using feeds to import them via a csv file to the new site.

My question is: Does this pose any security risks? If the D6 site has been compromised, could I be importing anything unpleasant?

Also would it also be safe to import nodes this way?

Thanks for your help,


Drupal version: 

Source: https://www.drupal.org/taxonomy/term/22/feed