If we're worried about theoretical abuse, the client could access all of your files because it runs as you.

You can opt out of the kernel extension? Still, you give it root to install, and it has a long history of hacking the file browser to get icon overlays... it seems weird to me that this would be a deciding factor.