It's all about the Flash security model.  The Control Panel, for instance, runs from local storage, so it has complete access to the host device.  Widgets, which generally come from the network, do not.

If a widget had local file access, there would be nothing preventing it from reading those files and uploading them to an external server.

The chumby actually uses a master/slave model to run two Flash movies at the same time - the master instance is usually the Control Panel, and the slave instance is created and destroyed for each widget.

You can run a widget from local storage using the profile.xml easter egg - however, it will still have security restrictions, but in a "file://" sandbox, not an "http://" sandbox.

The extensions we've made to Flash follow the original model - things that can affect the hardware, access the local file system, or otherwise have a global effect on the device are reserved for the master.

We often get complaints from developers about this - however, it's security best practices. Our primary interest is in protecting the user's device, files, and network.