Any user can specify an arbitrary directory from which to import pages. This could present an issue if the user chooses to import pages from directories that should not be read from. I think it would make sense if this operation fell under the administrate space so that this option was not available unless the requesting user had the proper permissions.

In the meantime, I can remove the relevant portions of the templates to "disable" this feature.