The need to disable the system command line functionality on the agent is critical.
While this can be turned "off" and "on" on the account level, the functionality still exists so that if someone did take over an account they could take over multiple servers. This is critical for security.
We need to have an option on the server agent that prevents the CLI no matter what setting is on the account.