Widget access request policy

The access request policy says to address security concerns.

This raises a few questions.

One is what are the security concerns.

Two is what of the previous DOM related security models does not address
them.

Three is unless all scripts are authored and packaged as widgets in
accordance to/with the entire widget specification set it would seem that
those security issues would remain.

Can someone clarify?