How is default-directory a safe variable?

From the documentation of `default-directory' variable:

  This variable is safe as a file local variable if its value
  satisfies the predicate ‘stringp’.

But how can this be safe? `default-directory' could point to a TRAMP
malicious host without the user even knowing, as the value in
.dir-locals would be read without any warning. What's the rationale
behind this? Asking out of curiosity.