LisPi on Nostr: The SSH client itself is (relatively) unprivileged though, the risk of the malicious ...

The SSH client itself is (relatively) unprivileged though, the risk of the malicious host reaching back shouldn't be any greater whether the server unwisely allows root login or not (and it should be just as compromisable without such login, or do you allow password-based logins that random programs could possibly bruteforce?).

I feel that I am not understanding the implied risk.