So anyone pulling a malicious dockerfile jeopardizes the host? That would be bad...

...no shit? Why do you think people care about this issue?