Most security stories start with someone breaking in. This one starts with someone clicking Preview. No transaction or alert or tiny onchain receipt saying "a crime may have occurred." Sometimes the dangerous permission is not "execute." It's "show me what would happen."