wemux use their own server-like process and joining/authentication procedures, they inherently increase the so-called "attack surface": that's more code which may have bugs, and bugs can easily become vulnerabilities.
However, at least
tmux has good repute, with, as far as this page says, was only ever affected by one known vulnerability, which was relatively minor (not a session hijack, but rights escalation into the
utmp group). Wemux is more recent, which may warrant some extra caution.
A more pressing matter is that if users can run
tmux on the host, then they can probably run arbitrary commands, which might be a problem if these users are hostile (to each other, or to the system in general), if only through simple DoS (e.g. a fork bomb). With forwarding-only, SSH can be "locked up" in a way which prevents evil users from being as much a nuisance to their peers. So it is not
tmux that you should be mindful of, but the extent of the services that you wish to offer to your users -- a full shell account, that's a big offering.