BGP is a system build based on two things primarily in this order - shortest prefix to reach an IP ( 99.99.99.0/24 takes precedence over 99.99.0.0/16 ) - shortest number of "hops" measured by how many AS paths it takes to get somewhere ( if you have multiple ways to get to 99.99.99.0/24, the way with the last number of autonomous systems "AS" in it wins )

So the result is that you have to somewhat trust who you are peering with, and who they are peering with, etc. to the other end of the traffic.

A bad actor can make lots of chaos.