by Tim Hunt.
The security risk is that when Moodle servers a file uploaded by a user, we expose ourselves to potential cross-site scripting attacks. Actually, it is no longer cross-site, since we serve files from the Moodle domain.
Therefore, any files uploaded by students must be served with forcedownload = true. (Just like any HTML input by students must be filtered by format_text.)