Secure in the general sense that a MITM (or similar) attack couldn't
successfully get the data from the file the user uploaded on the
client-side
MitM is not possible in such a scenario as the file never leaves the client so the attacker cant intercept it. However, an attacker with Man-in-the-Middle capabilities could still intercept your JavaScript code in transmission, so it is highly recommended to use HTTPS everywhere.
The website is written entirely in JavaScript to ensure it's purely
client-side
Well if there is no server side processing you have greatly reduced the attack surface.There is also no user base(cookies,jwt) i assume so an attacker cant target that either.The only thing i can think of is cross site scripting.An attacker could inject malicious javascript and then wait for the user to upload something,when the victim does he can simply retrieve that file.
Also i might add from androl's comment that you could also be "hacked" via vulnerability you introduce by using any piece of program that is vulnerable.But i wont comment on that.Always be updated and informed to prevent from such