Even if it were not possible to break out of restricted write18, there will exist installations with write18 enabled, and I can't imagine people remembering to check. Depending on the flavour of LaTeX in use it
If people won't remember, surely either the MediaWiki installer or the extension itself can be made to check this and simply refuse to enable <math> tags.