A malicious mod can trivially escape the sandboxed Lua environment to execute arbitrary code and gain full filesystem access on the user’s device.

Yikes