Trust in and maintenance of filesystems

I agree with this threat model.

It doesn't matter much if a filesystem can corrupt itself, as long as it can't corrupt the rest of the user's data. It matters a lot if a filesystem can corrupt the user's data on other filesystems.