It's extremely easy to slip exploits into mods. Big mods, especially. Slayer has 23,000 lines of server and client-sided code. If I inserted something into that, nobody would notice and it would affect a large part of the community. (not that I will - this is an example)
The mod doesn't even have to be very large, though. Backdoors appear now and then in Drama. Normally they're just commands to give the creator admin powers, but they could easily be something more significant. The thing is that nobody noticed them until they were used.
Those are just the intentional security holes. Like Lugnut was saying, I bet that there's a good number of mods that are susceptible to eval-injection or simply lagging the server with rapid command spamming.
