This is not hypothetical. Steam and Bumblebee did it.
Though rm /$TARGET where $TARGET is blank is a common enough footgun that --preserve-root exists and is default.
Without quotes it becomes: `rm -Rf /home/user/documents and settings /bin`
0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/commi...