Scriptlets have a simple ASCII layout and their code is available to anyone who wants to look at it. This makes code tampering, unauthorized duplication, and all kinds of violation possible. Consider that the source code you're seeing is exactly what makes that module run. If you modify it, changes will apply immediately (although it won't affect the server-held original).
Scriptlets inherit the characteristics of Web pages, which are intended to be public documents. If you don't mind your scriptlets being public software components, then it's alright—just write them and don't worry!
Technically speaking, scriptlets are HTML pages. However, DHTML is just the system API you're using to write them, and VBScript or JavaScript is just your programming language. What you produce is essentially a software component.
It's quite reasonable to expect support for some specific features like digital signatures and licensing in the future. If Microsoft wants scriptlets to become cross-platform Web components, then the next step is mandatory: find out a safe and efficient way to compile and certify scriptlets.