Comment by nrdvana

He said where untrusted parties aren't able to run rsync.

If I was running an rsync daemon facing the public, it would be in a chroot with dropped privileges.