Potential security problem: wallettpassphrase opens up the wallet for everybody!
Yes, any person you give your rpcpass and rpcuser to can control your wallet, that's not what the wallet encryption password designed to protect against. You really don't want to be giving arbitrary users your RPC authentication details under any circumstance, and I can't think of one where you would need to.