Glad the pptx worked!
The name is from "take a gander" which is like slang for "take a look". A gander is also a male goose hence the icon. 😛
Gander treats every file as untrusted. Documents render in a WebView that runs only Gander's own scripts and loads nothing except Gander's own code and the file you opened. With no internet permission, a file that got past that still couldn't reach the network.
Nobody outside has audited it yet, and you're right that it wouldn't hurt. SECURITY.md lists what a file should never be able to do, and how to report one privately: https://github.com/mokshablr/gander/blob/main/SECURITY.md