I don't think a 'protected' list of safe scripts is really possible. The 'how is the script *being* loaded?' issue has been overlooked. As there are no known bugs in mIRC itself that allow code insertion, a hostile script is either:
1) being /load'ed by the user, or
2) being loaded, or placed in a posistion to become loaded, by another process on the system, or a script that by this idea would have to be considered 'safe'.
In point 1, the user could be convinced to add the script to the protected list, or if this proves inpractical, given directions (such as loading a url) that would lead to point 2, where as a 'trusted' script or an unknown process, the list could be easily modified.
The safe list could also lull users into a false sense of security:
<Jack> that 0mgl33thax0r.ini is a virus!
<Jill> but its in my safe script list. GET A BRAIN MORAN!
(sorry.. :P)
By all means, added security to scripts *is* needed, and *will* stop a lot of worms/viruses in their tracks, but I really think a better approach is needed. (not that I can think of one.. )
(also: with your idea to restrict file I/O, a less 'destructive' idea is to only allow access to files inside the mirc/script directory, most scripts should be able to function normally inside this limitation)
Just my 5 cents <-- as I'm collecting all my one and two cent pieces, they might be worth something one day.