For example, if an app uses the JSforce framework to develop a page that uses AngularJS, could it be blocked because of this? I'm wondering because some parts of the code would have queries and other code that manipulates the data on the page, and it would store some records while the user is using it. Could this be flagged as a security issue?
I'm almost sure it does not, because we are using Salesforce's endpoints for manipulating data, instead of a custom Apex endpoint, and the user needs to be logged in to access the page and (probably) use the endpoints.