What is to stop you (or they) from entering that command directly into the command prompt you (or they) are using?

The danger is you can have a filename like  "rm -rf / |" so a ./foobar * ends up executing the command (and deleting files ) instead of opening that file

A workaround is to perl -MARGV::readonly foobar *