Well yes, when "code is data", data suddenly becomes very dangerous. This is recurring theme when dealing with Lisps and Emacs especially. For instance, it is also quite common for Emacs packages to save data in the form of ELisp code. When loading the data, it is simply evaluated and boom, your data is loaded. It's a powerful thing, but of course this is a security issue, and this is why we can't have nice things...