And Emacs will load whatever's written there on the next restart.
Whether the user wrote to those files, or someone else.
Yes, and your point is..?
That whatever malicious code we try to protect against using the
"trusted content" mechanism would be executed anyway.
The scenario I have in mind is this:
. Emacs session is running; when it was started, there was no
site-init file
. User notices that site-init file appeared
. User visits the site-init file
. Malicious macro in site-init file is executed
IOW, there could be valid situations where the user visits the file
before restarting Emacs (which would load the file). In these
situations, it would make sense to treat the file as not trusted --
unless the user tells us it should always be unconditionally trusted.
IMO, we should only make files and directories trusted by default if
we are either 100% sure they can never be malicious