What are the main vectors of attack? Any tips?
no not really but it can and has happened.
theoretically someone could go to some work to rate themselves up with dummy accounts or do smaller transactions to gain trust to then go rogue(disappear) with larger ones.
so in regard to this its important to look at who rated them and what their rating is. its a bit like ebay and even then they may still just decide its worth disappearing for a $1000 trade (or any number)
so to be safe with bigger numbers (and/or if your dealing with low rated users), you can do them in smaller segments one after the other or use an escrow service like clearcoin
another thing to remember is that nearly all the risk is worn by the seller when you are talking paypal trades as its them that bears the risk of a payment being reversed (chargeback) even many days/weeks afterwards. (and even not deliberately if it turns out you ended up with some stolen funds)
anyway theres alot here about it all http://wiki.bitcoin-otc.com/wiki/Using_bitcoin-otc