And you can tell me it isnt doing anything bad and should be trusted all you want, it's hot air. You cannot demonstrate that this thing is safe.
What's stopping you to make a special locked-down profile for it in selinux, apparmor or whatever favorite RBAC system you have and then check for access violations? THEN you'll know if it messes up with the system.[*] Or are you trying to argue that the client is bidding its time now, playing it safe and will do the nasty things only when Skynet becomes operational?
[*] Of course, 'demonstrate' is not what this would be doing. One can't demonstrate absolute safety on a system that can update itself any more than one can predict the future. However, one can obtain a reasonable system lockdown with judicious use of RBAC and if that is not enough for you then maybe you shouldn't be contemplating gaming on such a high-security-requirements machine in the first place.