In a hypothetical scenario where someone has access to someone else's account, the person could run any commands they want.
Last night I powertool'd the command "/clear" to my water bucket instead of "/fill clear" expecting it to remove the water in my bucket and lost my Star shovel as a result....
Yes, sadly. Countless dollars and hours down the drain because of this command I do not want access too.