Basically what it says on the tin. Is there any reason why IPFS clients couldn’t keep themselves up to date by querying an IPNS name for new versions?
On the security side, I don’t think this would be much of an issue: the vast majority of us already trust the IPFS org on GitHub to distribute clean updates. Have it disabled by default and let people choose a different name to watch, and I think that problem would be solved.