> Well, maybe. Mass-assignment exploits on Event are probably trivial.

Yes, that's true — anyone could hand-create a form submission and update any event attribute (AFAIK). Those would be a different class of users than the ones I'm talking about, though.

(If someone did maliciously modify an event record, there would be evidence of it in the audit log. We would be able to revert the change and suspend her access.)