Yeah but I think it's because it is a hierarchical structure. Active key has all permissions except for owner permissions.
So in my mind the posting key is just a limited scope of active. If it is entirely separate there's nothing to worry about, maybe.
Also, would the "depth" parameter not apply to active? Either way there's a whole lot of trust given there.
The thing being worried about is devs creating tokens and allowing them to be transferred with posting key authority using custom JSONs.