Full access to the user's data, and ability to run 99% of code that one might want to run, is plenty bad enough already.