sv_allowdownload 0 & sv_allowupload 0, Is this absolutly needed ? (Sprays broken)


I have a quite simple question :
When I made my servers, I used a tutorial about how to set up FastDL (You have to learn somewhere), and it said to set sv_allowdownload to 0 for FastDL to work, and to set sv_allowupload to 0 to fix security issues.
I did that and my servers and FastDL works perfectly but Sprays are broken. Obviously, It’s because clients cannot upload and/or download them from the servers with these two values set to 0.
Now I wonder, what is the “Security issue” with setting sv_allowupload to 1 ? Of corse, that allow clients to upload stuff like the Sprays to the server, but I’d imagine gmod would prevent clients from uploading harmfull things, right ?
Also, does setting sv_allowdownload to 1 when using FastDL breaks it or not ?
I’d like the Sprays to work correctly on my servers, but I don’t want to put my server at risk if there is realy a security problem with setting sv_allowupload to 1, nor want to break my FastDL as my server send everything through it so it must not go back to ServerDL which is extreamly slow. Do I actualy have to set both to 1 for Sprays to work or only one of them is needed ?

Thanks for your answers.

source is a duct tape engine with exploits not being fixed by valve, there’s been remote code execution with spray uploads in the past, i wouldn’t take any chances