In PostgreSQL, REPLICATION is a highly privileged role attribute that allows a user to open replication-related connections and work with change streaming features such as logical decoding. It is not a general database admin right, but it is still powerful because it can reach code paths used for data transport, plugin loading, and server-side processing.
This matters in security because any privilege that can influence how the server loads or handles modules may become an execution boundary, not just a data-access boundary. In attacks, an adversary who gains REPLICATION access may try to steer replication sessions toward unsafe plugin behavior or other trusted loading paths. In defense, administrators should treat REPLICATION as sensitive, grant it only when required, review which roles hold it, and keep replication and plugin components patched and minimized.