[btian]

> chances of him getting hacked are basically zero

How do you know that? Your machine is probably still susceptible to POODLE.

He is on non-admin account doesn't mean the OS doesn't contain bugs that allow privilege escalation. And Apple is definitely not going to fix those bugs.