Agreed with how we currently see the problem. But attackers are crafty and will find new ways to exploit such capabilities, I have no doubt. The risk is low for the moment on websites and higher on social media. That will likely flip-flop as social sites block the SVG usage. Websites, and aggregation sites that pull those images, will be a greater threat long-term, but the attacker must gain privileged access to the site in order to seed the attack. Doing so, this may be one way to remain persistent longer as compared to just adding a JavaScript file to the main page. Stealth may be the lure. I honestly do know for sure. It will unfold over time.