"A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading."

That's true. But it is also true with the data files. They also contain Lua scripts... What's the real threat here ????