Well, the big issue is the "standard" dataconnection you set up in the infopath client when developing the form.
As far as we can tell this would be open to the users if the open the infopath in the client afterwards. We have around 20 users with the infopath client installed. These users develop infopath forms ...