<satellite:cookie> / CookieServer security?

I've just realised that <satellite:cookie> puts an img tag into the page which calls CookieServer with all the tag parameters specified in the URL - the returned 1x1 transparent image call then sets the cookie. Example: /cs/CookieServer?name=test1&value=test2&secure=true&timeout=3600&url=/

This means you can set any cookie for a WCS site simply by getting a user to click a CookieServer URL or by including an img tag into a page you own and then getting them to visit the page. This doesn't seem particularly sensible to me. For example, if someone has a WCS site with some JavaScript which isn't properly sanitising the value coming out of a cookie then this could be used to inject an exploitative value into a user's browser.