Even if it were not possible to break out of
restricted write18, there
will exist installations with write18 enabled, and I can't imagine
people remembering to check. Depending on the flavour of LaTeX in use it
If people won't remember, surely either the MediaWiki installer or the
extension itself can be made to check this and simply refuse to enable
<math> tags.