That's DOS-LIKE, not direct to AmigaDOS -- an important distinction. Letting a user romp around on your hard drives at will would be the equivelent to a death warrant for a BBS, generally. However, TPTShell is a special shell that protects you from such things. It only allows the user access to commands that you so designate. Commands not designated directly by yourself are not available. In the years that DLG has been in existance, there have been no reports of someone hacking a BBS via TPTShell -- none.
Of course, someone with 255 Sysop access has no such restrictions. You can execute any command that is in the DOS command path, plus quite a few that aren't.
The following commands are standard in the default DLG configuration: dir c:ls 1 1 cd c:cd 1 1 avail c:avail 1 0 status c:status 1 0