If a SSC zone started deleting files off players computers I think they would get taken off SSC (so there plugin privilege will be removed). Maybe it's possible for the client to remove some malicious function calls before executing the code? Rather like emulators changing the function addresses and stuff. Or someone could make a separate utility program to warn on bad code, then zone owners would get the choice to use someone's plugin or not without having to know about programming.