Just verified this. You cannot use it for /cast or /click, only things like emotes, chat, accepting invites, /follow, etc. If you try it, it says "Cannot call secure command: /cast" so I think the "exploitable" parts of this have already been secured.