It is possible. But they might not either. If security is a concern then you will need a custom plugin so the mod is server side vs client side.
If your community though is that advanced users could create a tamper monkey script and theme it from their browser.