if it can place orders, it can also easily steal funds from the account. How? All the attacker needs is to convince a few people to give their api keys that have some capital behind them, then buy some low-liquid altcoin and then use the low-liquid currency pair to carry out the attack. How? by ordering all accounts to buy this altcoin at one time and setting his account to sell. For example 100k $ is enough to create x3000 flash pump on THETA/BNB trading pair.
The attacker buys THETA for $3,000 and sells it for $1 million, while stealing $1.1 million from the attacked accounts.
I've seen something like this several times, and the most popular case was a few years ago on the VIA altcoin.
https://medium.com/chainreport/binance-phishing-attack-creates-api-pump-f4ef2160f3eaThis is exactly what they do, if you reach to a point where you can control hundreds of thousands of dollars via your bot, that means you could buy something with all the money that you made from this when the time comes, and then you are going to end up telling all the bots to buy something you already bought, then sell at the top, and tell the bot to sell it for everyone, if not enough people get out, you can keep repeating it multiple times since it is quite fast and before the people reach and stop and before the exchange stops you would be able to make it go up and down while buying at the bottom and selling at the peak with the power you have.
Not that I am saying these guys are doing it, but I am just agreeing that its possible.