I don't see the problem - it is restricted to the admin role due to the "as: :admin" on the next line.
This change whitelists the attribute for code that is executed with the admin role only.

Where could this be abused? Using it still requires an explicit ":as => :admin" in the code doing the mass assignment. If code that can be triggered by non-admins is executed with the :admin role, mass-assignment from user-controlled data should never be used.

By your logic, the projects_limit and can_create_group should not be set as attr_accessible either.