Your threat vector seems very specific. You are still talking about “biggest risk”. But without doing a proper risk analysis, for each individual case, this is

Your threat vector seems very specific. You are still talking about “biggest risk”. But without doing a proper risk analysis, for each individual case, this is just wasted speculation and a pointless conversation. If someone exploits a vulnerability, particularly if they gain root access, all bets are off, doesn’t matter the service.