Anyone with physical access to your device is now able to download and run arbitrary code. How is that not additional risk?