Can you convince me why I shouldn't be super-scared about these changes?

We are no longer validating HTML and we are now allowing Script tags.  Does this not expose us to XSS cross-site security issues?  For example, would a rogue course editor be able to insert code that takes your edX cookies and sends them to another server for spoofing attacks?