Is secure communication possible when using comlink with iframes?

Hey,
I was about to use this awesome library in one of my projects.
In this project I want to allow apps running in cross-domain iframes to activate functionalities in the top frame.
For this to work I exposed services on the top window, and in the iframe I used wrap in order to consume the activation API.
This, however, brings up a troubling security issue.
The exposed functionality on the top window is now exposed to any attacker who wishes to activate tasks in my app. Even if I guard myself from sending data by supplying a targetOrigin parameter in the top window, this only protects against outgoing messages but does not allow me to verify that I am accepting incoming messages only from my apps.
I read through the code and did not find this kind of validation on incoming messages.
Did I miss anything?
Is there currently a way to secure myself when using the window as an endpoint?

Thanks.