If someone can inject bad code for execution into the GPU that's also pretty bad though yeah?

The GPU should be able to pull and push stuff into memory, and maybe even access other devices directly over the PCIe bus?