Exposing Model to POCO in MVVM Entity Framework Application

To start with, I am dangerously bad at security. I am aware of this, which is why I'm asking for help to figure this out.

I have a POCO object, which is exposing an ICollection of a model object, so that I can act on it. Is there an inherent flaw in allowing this, or should I preferably be looking for another way to get the info I need from the Model objects without storing them in the POCO?