With Emplode/JEmplode and no Hijack, you can't (or shouldn't be able to, at least)

• write to the kernel area of flash
• change the running order (e.g. HTTP "play")
• remove or replace files outside of the music partions (e.g. the player binary), other than config.ini

Any attempts on the player are obvious when the music stops and an unasked-for synchronize begins.

Adding a wide-open Hijack does make me (even more) nervous.