You could have a lot of combinational logic dependent on floating/high-Z inputs, which is not good for CMOS circuitry.
Damage is probably more of a risk for an external I/O, but it's still a possibility for an internal I/O. Probably more of a certainty with a malicious programmer.
Who's going to be the first person to design an on-die switched capacitor voltage multiplier, using parasitic capacitance between gates as the energy storage, and use it drive an internal high impedance input to a damaging level?
so basically you cannot burn FPGA by making a short-circuit