I believe the same ‘trick’ would work with ShinyProxy, as it is not shinyserver-specific, but shiny-specific.
A way to restrict such behaviour (note that this applies to virtually any web app not limited to shiny apps) is to have extra checks on the ‘server’ side, i.e. in this case whenever input$variableSelector is being used by further R code.