From I have read, non-sandboxed apps could have freedom "to roam" (perhaps in ways that leave no traces) and MacOS seems to provide no way to restrict access to Notes along with other apps as well.
Even a thumb drive is not secure as there are programs that can sene a new drive and offer to scan it, but other programs may not announce their activity.
Security could be defined as standing in the middle of an empty 40 acre field barn of vegetation with NO electronics inside the field or on the body and you and other person(s) have positioned themselves in a sound proof enclosure that hides viewing of your lips.
It would have to be a randomly selected field and never used twice.
That is a rather cumbersome process. So we compromise to easier processes which we "HOPE" are secure.