Martijn DeVisser has a post up (with slides!) that does a good job of explaining why its a good thing that Flash can’t just arbitrarily load data across domains without permission.
You can read the entire post here.
Copyright © 2016 Adobe Systems Incorporated. All rights reserved.