> It's not that different from running any software from the internet.

I don't run "any" software as root or with even more privileges, so I would classify random kexts from the web as a highly critical threat. Of course you could be victim of an exploit even without willingly granting privileges but that's not really relevant.