Isn't it a security risk to allow arbitrary mongodb (or minimongodb) commands in the client side? In their demo, they show a client deleting data from a js cons

Isn't it a security risk to allow arbitrary mongodb (or minimongodb) commands in the client side? In their demo, they show a client deleting data from a js console. If that is possible, what prevents an evil user from doing the same to my deployed meteor app?