>write to the kernel area of flash
It's possible, in a convoluted fashion, beyond most script kiddies. But it's also relatively harmless, and easy to fix.
>change the running order (e.g. HTTP "play")
There's a play button in emplode (replaces running order).
>Remove or replace files outside of the music partions
>(e.g. the player binary), other than config.ini
But the files on the music partitions are the most important ones. All of the others can be restored to original state with a player upgrade. Music theft, substitution, playlist deletion.. those are the real issues to worry about.
Cheers