pull down to refresh

As @DarthCoin says, it's open source. where are the bad intentions hidden?
It's also voluntary; nobody has to use it.
What could be the bad intentions here?
It's traceable.