Totally right!
There are nulled scripts coming from so many sources so it's impossible to call any community "safe".
The best practice is to use nulled for testing and if you're happy with it then buy it from the developer.
You never know how that developer is going to take action against you...