There will definitely be clever attempts to game the system, but bringing the experience into the browser, and onto the user's device, gives us the home advantage.
We have a passionate group of security-minded folks internally who have been exploring ways to game the system, and closing those holes preemptively.
I'd love to see us publish something in the future about specific types of attacks which work on the present-day model, but not on our model. Additionally, what types of new attacks could be possible, and how we've prepared.
Suffice it to say, having the home-field (the user's machine) advantage is going to play well in our favor.
Great topic!