It's something I did give a little thought to, but it's simply that all new subdomains create a new router that only allow for static content and directory listings. So nothing's being executed server side.

A gave a little thought outside of that, but not much. I'm all ears if I've accidentally opened up a bag of worms!