They'd have to arbitrarily download and execute code from the internet w/ out any proper checks in place; not sure Vim does that by default...