In this case, the content is only stored local to the domain - sure someone could put the data that is some sort of Malware as the file that is synced, but they

In this case, the content is only stored local to the domain - sure someone could put the data that is some sort of Malware as the file that is synced, but they could also HTTP request it too... The theory at least is that the sandbox of the browser will stop it from getting out from there and keep the user safe.