You have asked important questions, and even more important details about such questions. Any consideration of any one aspect of any identified attack vector could be a lengthy discussion unto itself. You may wish to avoid letting the conversation derail into whys and wherefores, lest the signal get buried in the noise.