The most evil a use could really do is return more rows than we want or break the query.  Data updates and core updates don't happen under the select handler, only reads.