Technically speaking, there could be a security vulnerability on a dynamic site that is being hosted with mod_userdir, even though the owner of it is "trusted". With that model, if the security vulnerability is exploited by a third party to attack a different mod_userdir user, then it's not really about who you trust to invite, since the entire Internet is technically invited.