I liken it to hosting malware on the open internet. Yes the internet can serve malware, duh, that's the point. You can share whatever you want over the internet

I liken it to hosting malware on the open internet. Yes the internet can serve malware, duh, that's the point. You can share whatever you want over the internet and we wouldn't want it any other way. What matters is who you can get to download and execute it. And what they can do with that remote code execution. As always, the most secure system is the system that doesn't exist. Every other security argument has to contend with our desire to do useful stuff, and therefore it has to begin with a credible attack vector. Not just a hunch or some notion that it's "security best practice".