What immediately comes to mind is an underprivileged user being able to run things on boot as root, which is desirable to crackers that:
- Want to escalate privileges of other accounts
- Want to use your server to host a rogue service
- Want to start IRC/Spam bots if the server reboots
- Want to ping a mother ship to say "I'm up again" and perhaps download a new payload
- Want to clean up their tracks
- ... other badness.
This is possible if your underprivileged user is somehow compromised, perhaps through another service (http/etc). Most attackers will quickly run an
find on/of everything in
/etc just to see if such possibilities exist, there's shells written in various languages they use that makes this simple.
If you manage the server remotely, mostly via SSH, there's a very good chance that you won't even see this unless you inspect the init script, because you won't see the output at boot (though, you should be using something that checks hashes of those scripts against known hashes to see if something changed, or version control software, etc)
You definitely don't want that to happen, root really needs to own that init script. You could add the development user to the list of sudoers so that it's convenient enough to update the script, but I'd advise not allowing underprivileged write access to anything in init.d