What are the risks if my contract calls another with contract.call{value: msg.value}(_payload)?

What can realistically happen here? Considering we are not delegatecalling, to me it doesn't look like too much can go wrong even if contractis malicious.