Client niggers can:
>crash your client
>crash your steamvr and force you to reinstall your drivers
>see and manipulate your toggles and blendshapes locally
>see your steam ID
>see your IP (not pinpoint your home address, just an approximate location which doesn't really matter if you live in a populated area)
>fly around
>clip through walls
>see player bubbles through walls (even if blocked)
>go really fast
>optimize world for themselves
>disable post processing for themselves
>have more avatar/world favorite slots
>have a portable mirror anywhere
>avatar search by name

Client niggers can't:
>see your hardware ID
>pinpoint your house unless you are a retard and let them social engineer you
>doxx your identity unless you are a retard and have everything public online and let them social engineer you
>damage your hardware
>DDoS you (anyone can, but it's not done with a modded VRChat client)
>upload malware through VRChat (yet)

feel free to correct me if I'm wrong, or respond if there's something to add