Comment by motti

Indeed, WHATWG is currently considering [1] a related scenario where rogue websites with access to the clipboard will inject formats with dodgy payload to exploit flaws in some app if the user pastes.

[1] https://github.com/whatwg/html/issues/1244