I agree that it's unfair to tar the whole field with the blunders of the worst performers. But your comment I was replying to seemed to ask, "what's the worst t

I agree that it's unfair to tar the whole field with the blunders of the worst performers. But your comment I was replying to seemed to ask, "what's the worst that can happen?". It's a valid question for physical access attacks, but, once scalable remote exploits get into the picture, the worst that can happen is very bad indeed.