Security risk of $update_access_free = true in Drupal

What kind of potential security risk it raises if I开发者_如何学C left $update_access_free = TRUE in Drupal on a production environment? In that case, everyone can run update.php. Assuming there are no updates available, what can an attacker do?

---

If left enabled, an attacker could run old updates, which in a good scenario would only bog down your site's performance, but in a worst-case scenario could result in data loss or data corruption.

---

I wouldn't even allow access as it is unnecessary.

Someone could constantly access and run this page, using system resources.

---

If what you are looking for is a way to easily update your site, you should add a cron job with a Drush command to update the site at mid night. Now, from time to time developers release module fixes or upgrade that might brake something on your site. Hopefully in Drupal 7 the update can be done using the site interface and I am sure there might be some sort of console module to keep multiple sites update.