"And where does the "huge security hole" come from"

eval'ing a response from a third party essentially runs their code in your context. JSON.parse does not.