I use small local models regularly for coding. Worst I've seen is destructive git checkouts (can be fixed with git history) and maybe overwriting results of long regression tests unprompted.
The actually sane default is to treat it like a junior trainee you would never trust with rights to anything critical. Use existing operating system facilities, namely user accounts and file permissions, to make everything it doesn't need protected from writes, and everything it shouldn't blithely broadcast to the world like private data and keys, also protected against reads.
In my experience (mainly claude and Gemini argon, less so with gemini 3.1 pro), it's a bit worse. A junior dev won't hit "yes, delete" so confidently and think "I can just remake it" and proceed to ~~lie through its teeth~~ apologize 2 seconds later.