the pinning thing looks like other applications could assume it's safe when it's not actually, which is a normal recipe for a vulnerability. worth investigating at least