First and foremost, electron runs on often outdated versions of chromium which are vulnerable to known 0days.

Electron RPC also makes it really easy to get RCE if you don't implement it properly, and most JavaScript developers don't implement it properly. Electron also does not have anywhere near as much security research into it.

If you want to read more into the current state of electron security research, see https://blog.electrovolt.io/