Everybody can call every widget now.
I dont think its a good idea to allow this generaly. Particulary when it is about commercial content.
It would be a good idea to let the user allow/disallow this. Maybe for each single widget.
I will discuss this also in the Developer Zone.