There is no such thing as perfect security. There's always the possibility that something malicious is there. The real point it to take every caution that is reasonable and mitigate any possible damages.
If you're truly paranoid, you could choose to only ever run it in a VM that doesn't have any personal information and make backups of anything you don't want to loose.
I'd do it then. Ruin the benefit they have. (obviously easier said than done)