This requires an attacker to have physical access to a machine to change the shortcut. Adding the lines to the shortcut itself is also a nontrivial operation for most users that you must explicitly go out of your way to do. So that means this isn't a security issue (hence I'm lifting the security restrictions).

However, it may be worthwhile having Chrome display some sort of disclosure when remote debugging is enabled (or maybe it's not if people commonly use that mode to take screenshots etc.). +cc the devtools people for thoughts.

changing the desktop icon is a default behavior of adware to force a certain default page. Writing files on the desktop requires only low permissions. Because a user can not easily verify if this interface is activated, it is very easy for adware/malware to get password, other confidential information or adding adscripts to the page without installing an extension.