There's no direct financial benefit for running an API node. No cut of transaction or anything like that. I would say there is an indirect benefit though. By supporting the network and providing a better experience for users it can translate to a higher BTS price which benefits all Bitshares holders. As well, it is a positive mark for someones reputation in the community if they are doing other things like worker proposals or campaigning for a witness position. It's important for those people to be active in their support for the network and to do things that others may be unwilling or unable to do.

As for what a bad malicious node provider could do to harm a user or the network? The worst they can do is either feed the user bad data causing them to make decisions they wouldn't normally have made or blocking the users transactions from entering the blockchain. Both of these attacks from a node provider would be easy to spot and would result fairly quickly in destroying the node providers reputation in the community. If they held any positions of importance they would likely be voted out. It is also easy to switch to another node if you suspect something is wrong.

It's important to note that it's NOT possible for the API node provider to access any users private keys, funds, or other personal information(other than ip address). A wallet provider could though, by injecting malicious java script so if you use a web-wallet you are trusting them not to do that, but a wallet provider and an API node are different things. Best practice is to use the downloadable wallet and hopefully soon we will have transaction signing apps or offline signing separate from the wallet, so even if the wallet provider was bad they couldn't get your keys. @jesta has developed something like this already for STEEM: https://steemit.com/vessel/@jesta/vessel-0-2-0-interact-with-steem-securely-from-any-website