The risk isn't that Riot uses the module maliciously. The risk is that the module contains a security vulnerability, and that someone else then uses it maliciously.