This will negatively affect tons of analytics tools.

Time to start blacklisting googlebot UA strings from my custom javascript tracking tools.

I'm pretty sure Google crawls with a client that looks like a real browser to check you're not doing thus type of thing.

I wonder how long it is until someone exploits the parallel nature of the googlebot's (presumably Chrome-based) javascript execution for general-purpose computation like mining bitcoins or something.

I imagine that Google imposes pretty strict limits on computation time for any javascript that is run, so I'm not sure how realistic that idea is.

Yes. If it really were able to deal with arbitrary Javascript sites this would imply that Google had solved the halting problem.

I imagine that those limits are per-page, or perhaps per-domain.

It is likely that googlebot is running the chrome browser, so anything you can do in chrome, googlebot can do too.