Without sudo privileges the worst they can do is nuke their own home directory, nothing else because that's the only path where they have write access.