What sort of damage can a Trojan horse like this do on Mac OS X?

Fortunately, unless a user is logged in as root, this type of Trojan horse cannot damage any system files as the permissions applied to these files protect them. However, it could conceivably delete any or all of a user's personal files. If a user is logged in as root, then a Trojan horse of this
type could delete system files as well.

A Trojan horse like this could also easily delete files on external hard disks, where users generally turn off ownership and permissions, authorizing anyone to act on the files they contain.