As far as I’m aware, most of the “dangerous” lua api (io/network etc) is blocked and only available to mods during the startup phase, and not otherwise during runtime.

But I’m sure there are workarounds. For one, I’ve written mods with rust for it, and you can require and then call any dynamic library through lua, with all of the io and networking you’d want, as long as it is brought in during the init phase. And the mods that do access the “dangerous” api, have to be explicitly given rights to do so (but again, by the server, not the clients) in the config before it works.

It’s not that bad for the most cases, as long as you trust the server. If playing single player, you personally control which mods get the secure environment access, so at that point it’s entirely your own fault, if you get exploited.

I can’t see the benefit, what am I missing?

I’m boosting this and the screenshots too, but just thought I’d point out for quick scrollers that it does not seem as dramatic as this comment initially lets you believe.

I mean it’s awkward, but just seems more like your usual social awkwardness/incompetence than malicious behavior as such.