Whoa, synchronicity
Just two days ago I decided to toy with cups-browsed on my Gentoo box (you'll be stunned to learn that it is not default-installed there!) because both my home and work printers now allegedly support "driverless printing"/"IPP Everywhere" which to anyone who's installed a printer on Linux was a rather tantalising promise, and browsed + Avahi seem to be the only endorsed way of achieving this.
In neither case did it work, if by "work" we mean "allow me to print a web page from Firefox on that printer".* So that was as far as that went.
I've always regarded Avahi/uPnP/DNSSD/Bonjour/mDNS/zeroconf (jeez, pick a name already) as asking for trouble to begin with, but will allow that it's what implementers do with it that you have to watch out for. I can't think of a much better example of doing something really stupid with it than accepting arbitrary, potentially root, code from any old Tom Dick or Kyocera that claims it's a printer.
I could see this being a useful way of frictionlessly adding a printer *if* used solely as an on-demand, one-shot "scan for printers" function when you actually know of a printer that you expect to find (and what it's probably called) on your network. Having it running permanently is bonkers. A server to handle the vanishingly-infrequent task of configuring another server?
It wouldn't surprise me if a lot of "user-friendly" desktop distros do enable this by default -- or at least pull it in with CUPS itself -- so I get that a fairly high level of concern is warranted, albeit with the caveats expressed by others.
[*Not that way it doesn't, but it is actually trivial to add these printers through CUPS's web UI if you know the printer's IP and the seemingly fairly universal format for ipp:// URIs.]