This is entirely how FP is supposed to work. Don't like that, don't use it.

It ships database files over the network and does that blazingly fast.

Exactly. It's not a security hole. It's just the architecture of the program.

It seems like many people have a hard time understanding this, including developers.

Any attempt to add any kind of permissions, security, etc, without addressing the nature of the architecture (that the database engine runs in the same address space / security context as the UI) misses the point.

Well, I had to call it something. File system DBs were a problem long before FoxPro’s DBCs, yes. Yes, it’s an architectural decision. Sharp cookies would just modify the files directly. But that would just trash data (or bump my hourly rate in the HR DB). Most of the time, “full access to data” doesn’t necessarily mean “run arbitrary code”. In this case, it does, which I don’t think folks expect, hence “hole”.