I new in Angular and I try to understand: 

The directive @ViewChild have any use without Elementref?

Elementref access to DOM direcly? or to Virtual DOM?

Why angular team say: "Permitting direct access to the DOM can make your application more vulnerable to XSS attacks." That mean Vanila JS is danger due the claim: JavaScript access DOM?