It looks like you can only disable GUI calls with it (the very sparse documentation seems to contradict itself a bit though). Also, a model in which you specify which calls you want to enable (and everything else gets disabled) is stronger than one in which you specify which ones you want to disable.

Indeed, it's the whole whitelist vs blacklist [1] debate. Whitelists are radically safer.

[1] - https://farm9.staticflickr.com/8669/16418068728_b8dd8aa200_c...