URLs can be dangerous in that they contain instructions for a server to
do something. When an unknowing user clicks on a URL the instructions
will run in that user's security context. So, if I can get a site
administrator to click a URL that includes QueryString instructions to
make me an administrator, I could gain unfettered access to their site.
However, by default, SharePoint protects against so called "one click
attacks" by requiring updates be submitted as a POST action (rather than
a get) and the request must contain a request digest initially issued by
SharePoint. However, most Web based applications don't have that kind of
built-in protection so they disallow URL files by default.