It is a risk if you have someone that wants to be milicious, he can steel information or remove important data that will cost you time and man hours to fix. There is another way to protect the system and you can do it with server triggers. This will allow you to grant db_owner rights to users that log in from the app and deny access if they log in with anything else.