Can a stranger do anything malicious if I add them as a user on my PS3?

You didn't buy anything, because he didn't sell anything.

You can't resell digital downloads like a physical disk. It's right there in the EULA that no one ever reads, because you aren't buying the game, you're buying a conditional license to play the game. Your customer rights don't extend to redistribution. With most EULAs, unauthorized redistribution is grounds to terminate your license.

So basically this guy sold you something he had no right or ability to sell you. He can continue to play his game, or "sell" it to somebody else, or change his login credentials. And if anybody from Sony finds out, his account could get deleted, so you, at best, can't play the game anymore, either. At worst they delete your account, too.

What do you do? Try to get your money back and don't buy digital downloads from a third party in the future.

It is more than likely that the person you "bought" the game from owns a digital license on their own PSN account. The way the system works is that you can buy a game from the PSN store once, but then download it on up to 5 different systems.

The seller wants you to take advantage of this policy by logging in as them, downloading the game, and using up one of the downloads. This is a total abuse of the policy and likely against the PSN EULA.

You can read a little bit more about this topic here: Sony getting stricter on PS3 and PSP game sharing and why it is a bad idea here: Why you should not game share.

Game sharing is a violation of the terms of service of the PSN and your account can be temporarily banned and/or suspended and with multiple infractions you could become permanently banned and lose access to all online progress and more importantly, all the money you spent to buy those games would be rendered useless.