Unfortunately themes are not 100% safe. Preview will be running in the context of the admin account and it can make AJAX calls to all sorts of routes.
Someone malicious can do quite a lot of damage with a theme, it would be very obvious by looking at the source code, but it is technically possible.