Now that I think about it, someone would have to go into the OS and change the IP settings of the NIC in the VM to get it to talk on the new network it was accidentally assigned to in vCenter.
So maybe this is a non-issue except in the case of a rouge admin. In which case if he/she has rights to login to a DC and change the NIC, he/she most likely would have rights to delete the entire domain or wreak havoc in other ways.
But I guess the question is still work asking.
SB.