Everything can be hacked but webrtc is encrypted and can only really be exploited with complex man-in-the-middle attacks where the attacker already had access to the victims device (which, as you'd know as a pen tester, is already the worst possible situation if the attacker has admin access to the victims device).
The fake game scenario, what message could be sent that allows RCE attacks? And if an exploit was found, this would be patched by Google/other browser devs.
Let's assume an attacker could send messages to fire "execute javascript" actions - this would be limited only to the game/tab and would behave accordingly as a browser does, e.g. The attacker tries to get geolocation, then the victim will see a popup asking to allow/deny geolocation, which they would likely deny.
File transfer, again I would not worry: let's say someone sends a virus exe file. Victim receives this... The victim cannot run this exe through a Construct game (unless very specifically using NWJS - Open Shell action, which, I would imagine is rarely used). Even if somehow the exe could be transmitted and executed, the victims device would have windows defender/antivirus software, most of which test an exe in a sandbox, or simply delete the exe if it is potentially dangerous, so no worries there.
But, yeah, any game engine, godot, unreal, unity, anything - can be used to make malicious software, esp with multiplayer functionality.
It's not the company's or Scirra's fault if someone designed their game poorly where geolocation data is easily sent unwillingly sent due to an oversight from the game dev, or easy packet sniffing/sending (I presume webrtc makes resending packets not viable).
Things like NWJS have already been used maliciously outside of Construct, to make cryptominers and such that run silently on the victims device. It's probably why antivirus software flag innocent exports of NWJS (or it relates to the exe being signed, who knows).
All in all, I wouldn't worry about this, and would only worry about how a game dev designs their multiplayer code - hopefully not having a game that relies on geolocation to play and has multiplayer, and peers have a button that a peer can click, to get host to gather all peer's geolocation data to send back to them. That'd be foolish and that game dev would certainly have a tarnished reputation after a stunt like that!