To be clear, an attack like that is pretty unlikely, since the bad guy would have to get into your personal network or access your ISP connection. Popcorn Time said as much in a reply to Torrent Freak, adding that the app also doesn't have elevated privileges, so it (theoretically) couldn't run code anywhere else in your computer. However, the company admitted that there are some security issues and plans to release a hotfix soon to address them. To be on the safe side, maybe stick to a legal option -- there are so, so many of them out there now.