And if they can access data, they can plant data.
Correct. “Plant” in data terms means INSERT, UPDATE, or DELETE. It just depends on who needs what. Easier than you think.