@Prof. Garfield this is an interesting topic. Personally, I feel like using Lua events to dynamically change or swap files within the scenario directory itself (and any of its subdirectories) is "acceptable behavior", but doing so within any higher-level directory (such as the main TOT installation directory, or anywhere else on the user's computer) is strictly "off limits". Note that I'm basing this not on what I'd like to do as a designer in my own projects, but on how I feel about an appropriate boundary for someone else's scenario that I download, install, and run. I'm willing to give a designer control over his own scenario's folder, since bad decisions there would only affect his own work, but I feel pretty strongly that he has no "rights" outside of that.
This seems like a perfectly reasonable restriction. Occasionally, when I've written quick and dirty scripts that have had to write files, I've written directly to the TOT directory, since it is easier. However, that stuff hasn't been meant to be used by the end users of scenarios.
Unfortunately you're right that any Lua script opens up the possibility of error or malicious behavior, or someone not abiding by this boundary, which could have severe consequences. TNO added a warning popup about loading Lua events... I'm not sure if enforceable rules (to limit the power of Lua in this regard) are possible or not. I do agree that the risk is very low at the moment, but it's something to be mindful of if the community grows. If a technical limitation isn't feasible, eventually I could envision some sort of "certification" program in which one or more experienced Lua programmers, who are known to the community, review the code in a project and publicly confirm that it's safe for general usage.
At the moment, if I'm paranoid, I can search for things in the code like 'os.execute' and 'io.write.' If the code is supposed to be writing stuff, then I have to figure out if what is being written is advertised, which could possibly be a bit more involved.
What we might do, is write a library with all the possible things you could want to overwrite (or, that are considered 'allowed' to be overwritten). For example, overwrite.rules(newRulesName), overwrite.movpiece(newSoundName).