This is terrifying.

You could hijack a user that has SAPGUI open, then push code updates to SE38 that spread everywhere.