You should operate on that assumption, yes, unless you wrote or have reason to deeply trust the code running on it.