A mIRC script could possibly send/receive data by other means (for example via sockets), that is: regardless of your DCC settings.
Because most users are not able to evaluate a mIRC script on their own, they can only rely on trusted users/websites. Yet it's
your decision to load a certain script
If you decide to load it, you're giving "your permission" to do <whatever it was set to do>, so to speak. Every script requires to be loaded at least once, everything after that
may be automated and run in the backround.
Also note that while you can lock
some of the most potent/dangerous commands at "options -> other -> lock", this does not relieve you from the aforementioned responsibilities. It's a good idea to have these commands locked unless necessary though. A lot of scripts won't require them, others may not work without them (and a "good" script will inform you if you have to unlock a command, and why this is required).
In other words, you cannot achieve safety with "correct mIRC settings" or by blocking/disabling this and that - you have to use your wits, or reject scripts generally. Every command with a possible abuse was made for a certain use - mIRC cannot tell them apart