So the only practical limits to what can be used in a mashup setting are the limits that the enterprise attaches to accessing its data, right?

Absolutely.  But don't forget that a good enterprise mashup platform can help by allowing very dynamic access controls that are driven from your current security/governance software.