2. It's javascript running in the browser, it can't do anything that you couldn't already do with javascript running in the browser.

3. The same way that companies currently cope with clients. It's not like client-hacking isn't so common-place that you have to design around it anyway.