This is probably a good reminder of something else: using selinux/apparmor/tomoyo/... can save you from many situations where you'd be exploited otherwise. For example as a response to this you can set a policy on lesspipe and all its children so that they cannot access the internet or write outside of temp directories.
Whatever library is used by lesspipe - you're safe as long as the output terminal and your kernel are safe.
Whatever library is used by lesspipe - you're safe as long as the output terminal and your kernel are safe.