We didn't focus on candy security only (hard on the outside, soft on the inside). Even if you are trusted, and inside a cluster, you're still limited to active attacks only--that is, refusing to relay messages you don't like (but not editing them!). You still have no idea (hopefully/usually) who has requested a file, who has offered the file, and you usually won't even know what the file was unless you've already obtained a copy of the torrent file.