The Customizer lets users preview changes before publishing. Each set of changes is stored as a changeset record, which allows drafts, scheduling and previews, and these records live in the database alongside normal content.
Features that store data and render it later can be affected by security flaws, and stored data can remain after a site owner thinks a problem is gone. Core code and plugins that extend the Customizer both matter here.
Keep core current, limit which roles can use the Customizer, and when investigating an incident, review changesets and other less visible post types as well as pages and posts.