I can decide to connect only to trusted hosts. Having an automatic connection breaks that limitation.

You ask for a real attack, but you don't seem to accept the example that you were given. I'm not sure what your point is.