if he can place orders, he can also easily steal funds from the account. How? All the attacker needs is to convince a few people to give their api keys that have some capital behind them, then buy some low-liquid altcoin and then use the low-liquid currency pair to carry out the attack. How? by ordering all accounts to buy this altcoin at one time and setting his account to sell. For example 100k $ is enough to create x3000 pump on THETA/BNB trading pair.

The attacker buys THETA for $3,000 and sells it for $1 million, while stealing $1 million from the attacked accounts.

I've seen something like this several times, and the most popular case was a few years ago on the VIA altcoin.
https://medium.com/chainreport/binance-phishing-attack-creates-api-pump-f4ef2160f3ea