If you design a system where remote users are impacted by other remote users' malicious actions, you've just created a bad system. "Criminals" can still do anything they want to the firmware of a JD, it's just illegal. Nothing actually stops them. But if JD designed a system that prevented local modification from affecting others, then they wouldn't have this problem.