Can someone explain why you'd ever want to run this in the non-dryrun mode?

I understand that if you have these problems you've already effectively granted those permissions anyway but actually executing them before someone finds them lowers the bar quite a bit for other baddies to attack.