It is always suggested to enforce authentication on Bitcoind RPC. However, in case the RPC authentication get compromised (or if it is public), what kind of bad things could happens?

First I could think of money lost

First wallets are exposed and all the private key will get exposed, and it essentially mean all your Bitcoins can get stolen

Second with setTxFee function, any transaction created using the node will either has insufficient fee or just too much fee

Apart from money lost, is there any other things that may potential happens?

For example, if I just run the node as a block tracker and monitor if any money sent into my address. Does RPC has the ability to affect them as well?