I suppose this is somewhat insecure since professor A could change the url in their Canvas course's LTI connector to point to professor B's WeBWorK course url. Professor A would then be able to access prof B's course at the professor level. Since there are only a few of us using the system though I'm really not worried about that at all.
I suppose if I was worried then I would configure WeBWorK to only auto-create accounts at the student level, then professors would need to log in through WeBWorK directly rather than through Canvas.
Mike