This seems like a good place for folks to whitelist what commands are executable via web services. Perhaps add a hook here, and document it is in api.drush.inc. See http://api.drush.org/api/drush/includes%21command.inc/function/drush_command_invoke_all/master