Just by creating a new address and exposing your seed your tokens are at risk for most users, especially since waves is not supported on ledger or any other hardware wallet.
So the ways i can see people lose their money is:

1. Most obvious, transfer fee 0.001w and maybe back afterwards 0.001w. Not much but might actually be more then the airdrop in bch, since nobody knows the amount.
2. Falling for a scam, somebody creating an identical pywaves git rep but with a slight modification that generates compromised addresses.
3. Accidentally sending the WCT to the wrong address.
4. Losing the new seed for the new account, most people dont create new accounts everyday but have a solid tested one and dont want to change bc time have proven it to be safe.
5. Time is money

So surly there is a risk, and without knowing the reward i dont think people should bother. The whole announcement was badly formulated to start with, could have been such a great marketing opportunity if done correctly, such a shame .