No directly, but he could deploy code that had access to customers' wallets. Which is even worse.