Maybe 15 years ago I found a homenode exploiting the ability to add JavaScript to do some nasty things. I can't remember exactly what happened as a result but my gut tells me that this was when the option for scrubbing 'risky' things from homenodes by default was set.