Comment by charcircuit

That limits what they can do, but it doesn't mean they can't do anything malicious. Someone could make a YouTube app which removes ads, but steals your session so that they can viewbot or spam comment sections with legit accounts.