It is baffling to me, as well. You know how you get a remote-code-execution vulnerability? You give a bunch of software permission to fetch code remotely and execute it.
And there isn't really a way to confirm if it is configured in a secure way.
You either trust the developer or not.
And, in many cases you can get some protection from a developer going rogue (or not writing perfect code), it's not an all or nothing.