from http://support.microsoft.com/Default.aspx?kbid=896054

Warning The MaxAllowedZone value enables all sites in a specific zone. Using UrlAllowList as described in example 1 may be safer. If you must use the MaxAllowedZone value, set it no higher than you must. If you set the value to 3 or higher, you expose your systems to attack from the [...]