I read over the document and the security considerations don't seem super clear. If I find an XSS on Cloud 9 or some other web-based IDE that users are likely t

I read over the document and the security considerations don't seem super clear. If I find an XSS on Cloud 9 or some other web-based IDE that users are likely to grant directory permissions to, I can ransomware every file in that directory without requiring extra permissions? In other words, granting this permission is effectively the same level of severity as downloading and running an app. Am I missing some extra consideration here?