We don't follow the BigChainDB product closely, but we know that early versions used a shared data layer between all nodes, meaning that one malicious node was able to corrupt the state of all nodes. I believe they may now be working on a new version which changes this, but you'd need to ask them for more details.