Depends on the terminal I think. Pretty sure KDE's Konsole warns you that commands may be run when pasting something with newlines, but still allows it.
Well they did have the type the command, and to do that they would first have to navigate to the terminal (assuming the machine isn't running just a plain tty) first.