How safe are PostgreSQL triggers against attacks?
Security in ANSI relational databases is normally based on layers and one of those is role based access.  A business case that no one will ever need to delete or edit data in some tables will probably need to be revised when someone makes an oopsie and bad data is entered.

Any code that is written whether it's in a trigger or stored procedure has a chance of being misused but this requires access. A better solution than writing triggers that prevent basic operations on data is to control access and permissions by creating roles for each type of user and granting permissions appropriate to those roles.