Using the frontend will certainly be a risk, however, I am not very sure if using Tornado Cash by connecting directly to the smart contracts is safe or not after the sanctions by the American government.
Is their mixing process reliable to begin with? I'm not familiar with how they work, not to mention they mention some RPC blocking can hinder their service if they do still run it right now. At the end of the day though, I would be surprised if the government just stay still and do nothing to decrypt/analyze the transactions made through them. Would be a weird move since they can use that as a basis to sue others. CMIIW.