https://t.me/EOSproject/1966958
The whitelisting service can add bad actors and members can vote for bad actors. Those bad actors just need to:
1. Be transparent about their use of funds. 2. Not run more than one BP. 3. Not buy votes.
You can obey these rules and still be a bad actor.
As for the attack, literally anything is possible. Depending on your perspective of what a bad actor might do, they could either "unlocking frozen tokens" or "print tokens".