contain security or privacy

The custom visuals in the Visuals Gallery are reviewed by Microsoft prior to being published. With Javascript, it is possible to do pretty much anything, so the warning and review process are there for good reason.

For example, it's possible to create malicious visuals that can alter other charts or send private data elsewhere. That's not unique to Power BI--it's possible in general for web development. Something like this "donut eater" that replaces the donuts from other charts would never be approved for the Gallery, but anyone could package something like this independently as a .pbiviz file and distribute it outside of the Gallery. Replacing an image is kind of a fun example, but what if it subtly changed *values* in those charts--or worse? I would heed the warning and, in my opinion, only use visuals from the Gallery or ones that have been otherwise verified to not contain dangerous code.