Let's not raise the barrier of entry without cause. Show me viable cause
and we can talk about specifics.
I do agree that Pear needs to be split away at some point when it is
mature enough to split. And applying some ACL's to separate doc, web and
src code probably makes sense as well. But let's not take this further
and start changing something that has worked very well for many years.
I think this is the most reasonable point to start...
doc,web,src[,pear]
Anyway, if someone was really evil, he could gain trust and cvs access somehow (using current rules or wait-a-few-weeks rule), sure it'll take some time but I don't think this is efficiently preventable until accidently detected.
andré