Phrased differently: Quake 3 servers could publish server mods that would be executed by the clients. This is the same security risk that anything with plugin/

Phrased differently: Quake 3 servers could publish server mods that would be executed by the clients. This is the same security risk that anything with plugin/extension/mod functionality experiences. Generally, the best way to secure that vulnerability is to verify downloads from a moderated source, i.e. run a mod forum/plugin repository that disenfranchises bad actors and verify checksums at download. A good example is Emacs and melpa.