A lot of the suppossedly nulled templates and scripts come prepackaged with shell 'bonuses'. Sometimes they're even encrypted-obfuscated. A shell script such as c99 can compromise not just all of your data/website, but other people's data on the server, and the server as a whole. I use a modified version of that script I found on a client's website to test my servers for vulnerabilities.