Yes, it boils down to "be careful with untrusted code" no matter where it comes from. This is certainly not unique to emacs.
I'm starting to get "return to notepad++" vibes from HN today.
Well I use mostly stock emacs. If that's already owned, then I guess I'm screwed. I'm very selective about adding additional packages or using other "uninspected" elisp code.