Today a colleague synced 11K raw records in Marketo (in Lead Database) to a Salesforce campaign. The impact on Salesforce was dramatic. Raw hand raises, recruitment candidates, qualified out leads, and more entered Salesforce. Some business units suddenly had hundreds of neglected leads, reports were corrupted, and more.
There should be a setting for user roles, who can 'lead actions -> saleforce -> Add to SF campaign' (or update, or delete). This should make sure only experienced Marketo users are allowed to do this.