At that point, I got a bit scared, too. This feels way too much against the rule of thumb that code consuming untrusted input should never be able to modify or

At that point, I got a bit scared, too. This feels way too much against the rule of thumb that code consuming untrusted input should never be able to modify or control it's own configuration or binaries (or, more generally, trusted input). In this case, the attacker can hijack 50% - 100% of the configuration of the weighting algorithm. For bitcoin, you can control around 4% at most without risking immediate attention. Unless mining speed increases by a factor of 40 or 50 suddenly.