To sum things up: a downloaded single player missions is about as dangerous as an 1946 mod - with the big difference that the mission scripts are distributed as clear, uncompiled source code, which makes it much more likely that hypothetical bad boys might actually be caught.

This is a good summary. Also, it should be noted that it is the .cs files that can do the damage. As far as I know, a single .mis file can't do any more harm than the ones from the original IL-2.

Yep, plus decreasing the scriptings permissions is a relatively easy dev change too, especially if the just used .NET 4's dynamic compilation. I'd hope they'd add it to the things to do, even if it's a long list at the moment :)