I think that the security risk is not that big in case the index.html runs on the client end (on the user’s browser, not on the Discourse server).
Also the advantage in the mpld3 approach is that it is a single-file with no dependencies. If you run raw Python you have to also be able to upload all dependencies like csv files, data files, etc. that are the source of what you want to plot.
Having said that, to be able to run raw Python scripts inside a Discourse post would be just fabulous!