Good question.  I've thought about this a bit (and poked through a bit of code), and I'm pretty confident it's safe.  In particular:
- The controller's before is *always* called, and before the action.  So, any URL and/or user input that hits a controller must go through here.
- I intentionally put this *before* we run the ready() event to avoid some corner cases of something clever happening (although I'm not sure what this could be).
- I intentionally made this command occur on *every* request, not just the initial one.  This ensures that there's not some exploit with an ajax sub-request somewhere.
- There are zero instances in the code where the header name isn't hard-coded.  In other words, we have response->headers("foo", $bar), but never response->headers($foo, "bar").  So, it's impossible to "accidentally" overwrite this.

The only possible exploits I can think of are really badly-written contrib modules... but even then, I think it'd rather hard, and doing it the other way doesn't really prevent this from occurring.  In particular:
- a contrib module could do something fishy in an event.  This could be an innocent mistake, which is why I put it before we run the ready event.
- a contrib module could accidentally write their own before() function and forget to call parent::before(), which could be an innocent mistake.  However, this would be the least of their problems since Gallery::ready() also wouldn't be called.
- a contrib module could write their own Controller class and bypass ours.  This wouldn't be a very innocent mistake.
- a contrib module could run a command like response->headers("X-Frame-Options", "IHEARTCLICKJACKING"), but then again they could have also run a command like header("X-Frame-Options: CLICKJACK4FUN") and created the same problem with the old setup.  Neither of these are terribly likely.
- a contrib module could call exit and force the entire script to halt.  Again, if this happens, I imagine that this may be the least of their worries.