There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.
My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default.
One method works, one doesn't.
But keep on telling people to read a book, for all the good it will do.
There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.