Xposed can bypass magisk?

[mywalkb]

I translated this comment in

Given that it is almost impossible for a user to refuse a root request for an xposed module

I'd like to understand, without make useless comments in PR, why for a user is almost impossible refuse root request?
I think if I dont't trust of module, I don't install it.
A xposed module can bypass the authorization of magisk? Xposed/LSPosed is insecure?
Sorry for my noob requests, I'd like understand.

[yujincheng08]

No. That sentence means there are too many dumb users that always grant root to xposed modules.

[mywalkb]

ok, so my very restricted list is secure.
I use only apps which require root, magisk module and xposed module open source and I execute some checks before install them.
For example I haven't installed shamiko because I can't find source.
For cli and dump users, just set disabled by default and enable it on preference with a switch and maybe a question "are you sure?" Yes I'm expert or Yes I know what I do.