Basically all local data is considered trusted, and proper ACLs and limits need to be explicitly configured. We are also free to let protocol non-compliant servers burn in flames.