Does it need to be? What are the realistic security threats?

If it does, then it can be put in the WeakMap:

```js
priv.set( this, {
  handler: [ the handler object ],
  actionMenu: actionMenu
});
```