I would say that it is safe at compile time, since PSTricks and TikZ only write PostScript in a file, but do not execute it.
The security hazards are related to the execution of the PostScript code, which is done in the PostScript interpreter (viewer) or in the printer.
In principle, PS is a turing-complete language, and it even has the possibility of open files for reading/writing, so if the interpreter allows it to do that, then the security risk is real.
This is what RFC1341 (about MIME types) says about PostScript (sec 7.4.2):
The execution of general-purpose PostScript interpreters entails
serious security risks, and implementors are discouraged from
simply sending PostScript email bodies to "off-the-shelf"
interpreters. While it is usually safe to send PostScript to a
printer, where the potential for harm is greatly constrained,
implementors should consider all of the following before they add
interactive display of PostScript bodies to their mail readers.
The remainder of this section outlines some, though probably not all,
of the possible problems with sending PostScript through the mail.
You can read the rest in the RFC, but basically it can rename, delete, create, etc. files. It can even load an execute machine code (kind of TeX's
\write18). It can alter parameters in the interpreter which can be retained across documents, altering the way other documents are processed (i.e. it is possible to "infect" the interpreter), etc. Not to mention the possibility of bugs in the interpreter which could be exploited.
However, I don't know if all those risk are purely theoretical, or if there was indeed any actual case of PS-exploit.