Everything is unencrypted so anyone between you and the server can change or drop packets. Theoretically mods shouldn't be able to attack the client but they have quite a lot of control over the server and other mods.
The biggest threat to me is the unencrypted stream. The other issue is that mods may have security issues that allow a player to crash the server or do something nasty. Last time I checked there was some work being done to secure Minetest better but I don't know what the status is.
I have been playing and joining a ton of servers since I didn't know about this, I guess I'll have to re-think from ever doing it again, thanks for explaining and sharing that!