If it doesn't create a new attack surface by rendering HTML unprompted, it can't be that bad.