Martijn DeVisser has a post up (with slides!) that does a good job of explaining why its a good thing that Flash can’t just arbitrarily load data across domains without permission.

You can read the entire post here.