That is a good question.

As long as you trust Steemvoter. That means not only trusting that authors of such site are not malicious, but also that their code and deployment procedures are secure enough so it won't be abused by bad actors.

Private posting key has no access to funds on your account, so in worst case, malicious user who steal it would be able to make/edit posts and comments, reblog and upvote on your behalf, possibly affecting your reputation both as number as the real one.
You can change your posting key at any time using your active key.