With control over the mirror list you can prevent certain users from getting updates which is a security problem but without being able to sign packages the danger is limited.