These preview vendors nowadays aren't coded through the currency system anymore. They just intercept the buyitem opcode and stop right there if the vendor is a preview vendor. This is impossible to exploit and thus there are no security issues.
And it is possible to do a preview vendor with LUA? or must be C++? And where can I find a example.