That is not a bad model if you completely trust the server owners. I feel there are more secure ways, but I suspect if a Arma3 server wanted to infect a machine with a bad mod they could. so the threat vectors are the same really.