Yes it’s possible to a user with development knowledge to access the values written in the custom states and even modify it, however that’s only through very intentional technical fiddling with the page.

You can safely expect that the user will not accidentally change the custom state.