Because you can inject foreign script into a page and mess with it. It obviously has positive aspects, but like any tool, it can be misused.

It generally wouldn't matter if somebody messed around with a page in their own browser, because they could only steal info from themselves, or damage their own copy of a page. Except that, because of products like GreaseMonkey, there'll be a market for packages of these extensions from third parties, introducing a trust problem. Civilians will be using them without being really clear on just what they do. That's an opportunity to slip in trojan horses.

I don't mean to sound negative about it. I'm sure it's 99% wonderful. But I"m thinking ahead to a new interface that's going to pack a lot of power into script on the page (so it runs in your browser and uses your cycles instead of my server cycles), and it'll necessarily have to contain some sensitive info on the page. That's why I'm working on a "hardened" page design based on the assumption that somehow, despite filters like the one we already have here for posts, someone, will find a way to sneak script on to my page. So I plan for the worst, and hide stuff in my script so that other script can't touch it. It's tricky, but it's coming along.

So, ya see, GreaseMonky validates my paranoia. It's an actual nicely-packaged tool for hacking my pages!

Course, on the plus side, it's also a validation tool for me. I'll just have to make sure my pages can't be touched at all by GreaseMonkey.

It's a jungle out there.