flutter-tvos is a build tool. It runs on your Mac, downloads a pre-built engine from engine-artifacts, and signs that engine with your own certificate. Anything that lets a repository, a plugin, an engine download or a generated project run code you did not ask for, or read a credential it should not, is a security issue.
Report privately, not in a public issue, through GitHub's private vulnerability reporting on the affected repository:
Include the flutter-tvos --version output, what you did, what happened, and
what you expected. A minimal project that shows it is the most useful thing you
can attach.
You will hear back within a week. A confirmed issue is fixed in the next release of the current Flutter line, and in older lines where the fix applies cleanly; the advisory is published once a fixed release is out, with credit to the reporter unless you ask otherwise.
Reports about Flutter itself, the Dart SDK or Xcode belong upstream: Flutter, Dart, Apple.