For security issues, I'd blame the person generating code using malicious foreign input and then running it or passing it around. There are less elaborate ways to be exploited.
Let me bikeshed. I can't picture a normal file that needs more than say, 100. Someone that wants 10,000 should think of new solutions, and I would advocate a shorter limit. Then again, I've only ever written lua for humans.